General
- Target New Doc (Payment Confirmation)_PDF.exe
- Size 413KB
- Sample200701-1zvg5ajy3e
- SHA256 4e8ddcec5c75934d0418b3f5f66c20925bd67b6acda0bb0c3a0ee684865a6e4b
- MD5 4f4b81b898333d4e1729cdfd63ae4dde
- SHA1 96a08f78b36c29632a714a19a262d43960f90b26
- SHA512 ef344509ad52c25afd2f43a369f2f2335055c40634852f3896df7904e4b2f7263d0736b0b22c899201736dc40d621892632099ccebdb1a159ad50a84b4083eb0
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
New Doc (Payment Confirmation)_PDF.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New Doc (Payment Confirmation)_PDF.exe
Resource
win10v200430
0 signatures
0 seconds
Malware Config
Targets
-
- Target New Doc (Payment Confirmation)_PDF.exe
- Size 413KB
- SHA256 4e8ddcec5c75934d0418b3f5f66c20925bd67b6acda0bb0c3a0ee684865a6e4b
- MD5 4f4b81b898333d4e1729cdfd63ae4dde
- SHA1 96a08f78b36c29632a714a19a262d43960f90b26
- SHA512 ef344509ad52c25afd2f43a369f2f2335055c40634852f3896df7904e4b2f7263d0736b0b22c899201736dc40d621892632099ccebdb1a159ad50a84b4083eb0
- MD5 SHA1 SHA512
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext