General
-
Target
20009389_pdf.js
-
Size
347KB
-
Sample
220921-q6m41scacm
-
MD5
789c174473988e1a09161dc099ab5242
-
SHA1
eb2b554e3218d76bd4d8c711667825fc4ea1ba62
-
SHA256
8b5beadb2b911f135987247781258de556dfbdcc58475dbba1702a414aa099df
-
SHA512
c7c1a40cac47b5068adc9f32f959fbcded69461dfe36649ddf3237dda8907db237b17c8c75987260812ffd9bb26f47489cf91e7510ed838620a1e269b8fbf49f
-
SSDEEP
6144:7mCYKw13CEAaCo1SfZFouO0Y/W86lnSUMSxZ3VhflI9xeuRu:+NfCZwuO0YInSUMEZ3DlITpQ
Static task
static1
Behavioral task
behavioral1
Sample
20009389_pdf.js
Resource
win7-20220812-en
Malware Config
Extracted
formbook
xrob
dV8FCtdWdnfMJ9thh8l/
IJG6Bh4iMeHVBHNp2MrpTA==
NhPKKtmQxnHYF/80
f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==
A/689/MibSRBgkPkx07m+H+g
e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==
gLN5bn+Zq1VQXmOOvw==
NFcQGvViY5sxmkty83Fde4GQhg==
XWMfFSM3f7GT9w==
Ih6vvqf9R8gDObM=
FGAlLASHlpLaUUKUJIwm9ABQ2Js=
v8R615LDC8iWchwv
m+u3rLUxScgDObM=
jc3eahERf7GT9w==
TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=
j6NQmhWeOi2B
aqJocUfM3v97ryScY6EiSMbVyBak
V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==
8zPsAt3ejcgDObM=
Rpe+BrGBzpGa9q8FHKpi
/WmW2322D7fNRPTILa58Juqk/ZM=
+RXDz2RnrG6J
G2uU9LualUtez4NigNITbgyuIybyPzM=
edeuu22xD1rTFu+ci/JLpyGuIybyPzM=
pP8hbRJZqelZrXS+HWDm+H+g
8STQ6HSb4lE4XmOOvw==
hr/lDpXMc4jYF/80
zQ/HzrVdryLZMvhEZ+Y=
HV4gPCecmZPFL8v1N6x1
LEf38qRZvLgqVfTXPa19
7euZ5pxpp2ZtrYb1N6x1
iqU5LgL782FBXmOOvw==
gtbwN+MldLRNoQZhh8l/
WUgMbA3KHBFYvlM6xk7m+H+g
b1zuBfz/FgrL92U4
Q6jeIxKBj5a+66DmTJCE7LZkK/eC/Q==
5BnV1pTXMa+W8aXGFVdhe4GQhg==
0UIRgvizzg8=
Cf/BDgD1/4JpqGQveZhw
+SPb0ojBEZzzTLk=
1ihEmlgPYYcJPPhEZ+Y=
va9ioKotR8gDObM=
66NR6ZvZGVfLLgOkSXLm+H+g
s7Ftp5/JE9zxPsv1N6x1
OZjAEbHmQr57flVNog==
SWYQJhbPGKdlXmOOvw==
D2UxQCXKFoVIoSu9IHUrWw==
ISLrKBL7AbPbCiJc5FAkMhM=
yhErdYm07KzDN9oFHKpi
vL5nTlhRf7GT9w==
p/wcbinhJe3eP90FHKpi
JCG1tJvLI+MUMwHVtw==
YKGzBi9gqWJ7tXgqW9cve4GQhg==
GzDd8t2F3lM7nzQw0Urm+H+g
gHo/fQEoa6tAVjiEqA==
zQ7U6cY1RYcJPPhEZ+Y=
BEEFEwEwYhkxlEUD+TMJnhs=
wfubpSsNjM5t4sOGqWbFp+K6pc/n9Q==
NntHSf0ybNuawX/q4Blh68nzK/eC/Q==
BVRywXVfdfjPK+DImLD3SQBQ2Js=
pOOyL/izzg8=
2c2Sxo8iuKv0L78=
wRU0iU8CRLSS9Q==
+Sjk78IvKRNv364HcZ4l+bAXxhes
pauloeamanda.com
Targets
-
-
Target
20009389_pdf.js
-
Size
347KB
-
MD5
789c174473988e1a09161dc099ab5242
-
SHA1
eb2b554e3218d76bd4d8c711667825fc4ea1ba62
-
SHA256
8b5beadb2b911f135987247781258de556dfbdcc58475dbba1702a414aa099df
-
SHA512
c7c1a40cac47b5068adc9f32f959fbcded69461dfe36649ddf3237dda8907db237b17c8c75987260812ffd9bb26f47489cf91e7510ed838620a1e269b8fbf49f
-
SSDEEP
6144:7mCYKw13CEAaCo1SfZFouO0Y/W86lnSUMSxZ3VhflI9xeuRu:+NfCZwuO0YInSUMEZ3DlITpQ
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-