General
- Target PFI_RF5030_page-0001.exe
- Size 833KB
- Sample220808-j1j2vaaaa2
- SHA256 c78e508337c58080c5bf06e22c391e292c2e85e4d77ca39e032a5f84441eb17e
- MD5 c612f3851563baa0bf9ac2fff8878d73
- SHA1 5f8549ff68a73351134223a0ea5f8011c4ccb8e6
- SHA512 6729be62b441bfdb4d3fed231fc16da0036f791543c6cf9492b15d0c726a6ccef79f54ffb4a652dae188296482b2eeadcba16649fb977fc61d890d4b50b83a7b
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PFI_RF5030_page-0001.exe
Resource
win7-20220718-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PFI_RF5030_page-0001.exe
Resource
win10v2004-20220721-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target PFI_RF5030_page-0001.exe
- Size 833KB
- SHA256 c78e508337c58080c5bf06e22c391e292c2e85e4d77ca39e032a5f84441eb17e
- MD5 c612f3851563baa0bf9ac2fff8878d73
- SHA1 5f8549ff68a73351134223a0ea5f8011c4ccb8e6
- SHA512 6729be62b441bfdb4d3fed231fc16da0036f791543c6cf9492b15d0c726a6ccef79f54ffb4a652dae188296482b2eeadcba16649fb977fc61d890d4b50b83a7b
- MD5 SHA1 SHA512
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext