Extracted

• • Target

    Foundation.pdf.com

  • Size

    700.0MB

  • MD5

    c029b2ee56752a77b6f2506224ce9d1d

  • SHA1

    1aeb1c211dd367d958e8a49245c2851fb1df6fdd

  • SHA256

    a1d01034ff1527f196438acd996f40c66eb146d50b3e53865a82c8b452e3cdf2

  • SHA512

    edf79d8562faa879e9d21af9e87cb3d8576e6efd93fef93923651a706683a7b8d7820783019a38890d940439343da49438e0f795c862ac7728840de191c8ab38

  • SSDEEP

    12288:FT2RAZPpPvF2WK2MTVc3L/oDQ0tHV1ZRllyI/o75ffxR3GnBjL8nAlA7I:FTY8PtvgH2M5c3LstHVRS75BQBLak

  Score

  10^/10

  redline25.9discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Interview with Luis(Cryptopop) preview.docx

  • Size

    11KB

  • MD5

    6f9ada13f38aa43f66c1bf938dd5d75a

  • SHA1

    af7eff8d346183058421e31285a8518555ebd842

  • SHA256

    bf2ea87b4bf70b50eef4e9ab49ef2306e308a304405eb14462714d10e7513d94

  • SHA512

    a445bd560d2cc801377399ed084b10544ff0c1f5b03625390d779038d2de8e2b2d5387bade8989feb08c932e046df32e7299f6d3e08f673fe7aae8f2c0381f0b

  • SSDEEP

    192:xp6LvLxMtp4H8I9u6C8o4J7IfI6I+B1Duvh7x3Y8/6lw+E4cayUZsGI1OHEvxR/t:xsvLGCucJ7IZDuZ74lI4c9RX2E

  Score

  4^/10
  behavioral3behavioral4