DeleteOfficeData
GetOfficeData
Overview
overview
8Static
static
420200308-s...19.pdf
windows7_x64
120200308-s...19.pdf
windows10-2004_x64
83UDBUTNY7YstRc.dll
windows7_x64
13UDBUTNY7YstRc.dll
windows10-2004_x64
8486AULMsOPmf6W.exe
windows7_x64
1486AULMsOPmf6W.exe
windows10-2004_x64
89sOXN6Ltf0afe7.js
windows7_x64
89sOXN6Ltf0afe7.js
windows10-2004_x64
8cSi1r0uywDNvDu.xml
windows7_x64
1cSi1r0uywDNvDu.xml
windows10-2004_x64
8Behavioral task
behavioral1
Sample
20200308-sitrep-48-covid-19.pdf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
20200308-sitrep-48-covid-19.pdf
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
3UDBUTNY7YstRc.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
3UDBUTNY7YstRc.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
486AULMsOPmf6W.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
486AULMsOPmf6W.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
9sOXN6Ltf0afe7.js
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
9sOXN6Ltf0afe7.js
Resource
win10v2004-en-20220112
Behavioral task
behavioral9
Sample
cSi1r0uywDNvDu.xml
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
cSi1r0uywDNvDu.xml
Resource
win10v2004-en-20220112
Target
f74199f59533fbbe57f0b2aae45c837b3ed5e4f5184e74c02e06c12c6535f0f9
Size
847KB
MD5
37f78b1ad43959a788162f560bdc9c79
SHA1
992d530d4bb35fb8dbdfb690740ead6e0fa974ec
SHA256
f74199f59533fbbe57f0b2aae45c837b3ed5e4f5184e74c02e06c12c6535f0f9
SHA512
b36628838c4af9d7f4c67a2ffa3d91c25291c8ecb7ac29cf7f1ed16e19f2b8d0abaf04d8f5b83b4c3343874bf0db5d9e4e0b0b167b6e6ce67b1b4bfedd9d3aef
SSDEEP
24576:CkL6X/3PSCuflrdNZ4J00ZcmNh3wsAR36Mge:vLK/fS200ZcYh3kqpe
Detects HTTP links in interactive objects within PDF files.
Processes:
resource | yara_rule |
---|---|
static1/unpack001/20200308-sitrep-48-covid-19.pdf | pdf_with_link_action |
https://www.who.int/emergencies/diseases/novel-coronavirus-2019/technical-guidance/critical-preparedness-readiness-and-response-actions-for-covid-19
https://www.who.int/publications-detail/global-surveillance-for-human-infection-with-novel-coronavirus-(2019-ncov)
https://www.who.int/emergencies/diseases/novel-coronavirus-2019/technical-guidance
https://www.iata.org/en/programs/safety/health/diseases/#tab-2
https://www.who.int/publications-detail/disease-commodity-package---novel-coronavirus-(ncov)
https://www.who.int/health-topics/coronavirus/who-recommendations-to-reduce-risk-of-transmission-of-emerging-pathogens-from-animals-to-humans-in-live-animal-markets
https://www.who.int/ith/2019-nCoV_advice_for_international_traffic-rev/en/
https://openwho.org/channels/covid-19
https://www.who.int/emergencies/diseases/novel-coronavirus-2019/technical-guidance/early-investigations
https://www.who.int/publications-detail/the-first-few-x-(ffx)-cases-and-contact-investigation-protocol-for-2019-novel-coronavirus-(2019-ncov)-infection
https://www.who.int/news-room/q-a-detail/q-a-coronaviruses
https://www.who.int/emergencies/diseases/novel-coronavirus-2019/advice-for-public
https://www.who.int/emergencies/diseases/novel-coronavirus-2019/situation-reports/
https://www.who.int/emergencies/diseases/novel-coronavirus-2019/technical-guidance/laboratory-guidance
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sleep
WinExec
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetLastError
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
HeapFree
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
LCMapStringW
MultiByteToWideChar
GetStringTypeW
DeleteOfficeData
GetOfficeData
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
DeleteOfficeData
GetOfficeData
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
CloseHandle
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
Sleep
CreateThread
lstrcmpiA
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
IsDBCSLeadByte
SetEvent
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LoadLibraryExA
GetCommandLineA
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
LoadLibraryW
lstrlenW
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
GetTempPathA
GetTempFileNameA
CreateProcessA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
CharNextA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
CharUpperA
UnregisterClassA
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA
RegEnumKeyExA
CoInitialize
CoTaskMemRealloc
CoRevokeClassObject
CoCreateInstance
CoRegisterClassObject
CoTaskMemFree
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
VarUdateFromDate
VarBstrFromDate
SafeArrayGetLBound
VarUI4FromStr
SafeArrayGetElement
VariantClear
SysAllocStringLen
SysFreeString
LoadRegTypeLi
SafeArrayGetUBound
_resetstkoflw
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_controlfp_s
??3@YAXPAX@Z
malloc
free
wcscpy_s
_recalloc
??_V@YAXPAX@Z
vsprintf_s
memcpy_s
memmove_s
_wcsicmp
strftime
??_U@YAPAXI@Z
strcpy_s
wcsncpy_s
strncpy_s
strcat_s
memset
??2@YAPAXI@Z
wcsrchr
vswprintf_s
fclose
fwprintf_s
fopen_s
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
_invoke_watson
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ