General
-
Target
Notification from SARS, Defaulter letter.PDF.exe
-
Size
308KB
-
Sample
201008-benqbcctmn
-
MD5
3a34763afced1c015e7dbf36bccd545b
-
SHA1
2d4ac07c3d4ede47c08accf50d0dcbbf23725090
-
SHA256
c1ebfaa5144a986271298dd044a82bc3e27362debe5475b028a916dbbfb97bbd
-
SHA512
5fbb1ff88aa011ec845c069905f8e5c73876810134614e68ebe0814dc549dd12d894a8317fb6cca95f9da9ef2b83c1d51f7d3499d14cc341fafef408b2efd7bb
Static task
static1
Behavioral task
behavioral1
Sample
Notification from SARS, Defaulter letter.PDF.exe
Resource
win7
Malware Config
Targets
-
-
Target
Notification from SARS, Defaulter letter.PDF.exe
-
Size
308KB
-
MD5
3a34763afced1c015e7dbf36bccd545b
-
SHA1
2d4ac07c3d4ede47c08accf50d0dcbbf23725090
-
SHA256
c1ebfaa5144a986271298dd044a82bc3e27362debe5475b028a916dbbfb97bbd
-
SHA512
5fbb1ff88aa011ec845c069905f8e5c73876810134614e68ebe0814dc549dd12d894a8317fb6cca95f9da9ef2b83c1d51f7d3499d14cc341fafef408b2efd7bb
-
Modifies firewall policy service
-
Sets file execution options in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-