Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

Order_024,pdf.exe

windows7_x64

8

Order_024,pdf.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order_024,pdf.exe

  • Size

    4.6MB

  • Sample

    200707-5773bej1xe

  • MD5

    dfb5d8ee67b5b99694fb055bbffd267e

  • SHA1

    7907a954ba3f7bec7eda283bd6af94fcc5ea59a1

  • SHA256

    7c55ed9770b23295ab1f5554cb98298b6f2548ce263feaeb6f5e4cd0b26524fc

  • SHA512

    1b4857ec709de050bf623d4d43eeaef24cc1d9bb116c6185b9dfa0fbf3644467be4d33ab59205c9615f02e6e0b315a98a0ee3d3403cb1823525210a27ea0be28

Score
8/10
persistence

Malware Config

Targets

    • Target

      Order_024,pdf.exe

    • Size

      4.6MB

    • MD5

      dfb5d8ee67b5b99694fb055bbffd267e

    • SHA1

      7907a954ba3f7bec7eda283bd6af94fcc5ea59a1

    • SHA256

      7c55ed9770b23295ab1f5554cb98298b6f2548ce263feaeb6f5e4cd0b26524fc

    • SHA512

      1b4857ec709de050bf623d4d43eeaef24cc1d9bb116c6185b9dfa0fbf3644467be4d33ab59205c9615f02e6e0b315a98a0ee3d3403cb1823525210a27ea0be28

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks