Extracted

• • Target

    Purchase Order 21PTAES2110-2.pif

  • Size

    173KB

  • MD5

    12f34f9b5d3817801893ee1aad6a5ef3

  • SHA1

    d0e8e93451aaea3571419169e5fd73a5f2a31cc2

  • SHA256

    966c1a5412af27dde07c13cbb17b743eec085d16aeac60849af71d376d1452ac

  • SHA512

    5fd48762f0c164f3a38530cf98655d3151ccac4c3d7abad4e02285bb8946817356b10d1e30c052d6f0012a85ed8257f413aaff3397877d3dc36b9bb7f8a2d606

  Score

  10^/10

  trojanbackdoorsmokeloader

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blacklisted process makes network request

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2