General
-
Target
Swift_049949_pdf.js
-
Size
356KB
-
Sample
221012-r8194agbd7
-
MD5
f01befe67328d6895946ab4c8763f006
-
SHA1
b302694c2c69da517b88eec771d8fc2c13ad5a66
-
SHA256
4a9a8778e84343f5992bddbfdec6e7d45ca399d1f20a44bcb8eaccd05372f193
-
SHA512
012fd72d8a70023772345213fdefb6382e4658e97bfd27cd4610312e4aa7fd113bde436f159451b77688ca876401cd05b2a207d194a3e562b265fbcdfb0a17a4
-
SSDEEP
6144:BWCdn1qRUAtmWXwXXJ528/RpFH81oTrmYW1XEMnGWrUvfhZN8gkU9uQyp:BbqZmWXsXzLH981omYHMGWuZZOrU+p
Static task
static1
Behavioral task
behavioral1
Sample
Swift_049949_pdf.js
Resource
win7-20220901-en
Malware Config
Extracted
formbook
xrob
dV8FCtdWdnfMJ9thh8l/
IJG6Bh4iMeHVBHNp2MrpTA==
NhPKKtmQxnHYF/80
f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==
A/689/MibSRBgkPkx07m+H+g
e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==
gLN5bn+Zq1VQXmOOvw==
NFcQGvViY5sxmkty83Fde4GQhg==
XWMfFSM3f7GT9w==
Ih6vvqf9R8gDObM=
FGAlLASHlpLaUUKUJIwm9ABQ2Js=
v8R615LDC8iWchwv
m+u3rLUxScgDObM=
jc3eahERf7GT9w==
TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=
j6NQmhWeOi2B
aqJocUfM3v97ryScY6EiSMbVyBak
V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==
8zPsAt3ejcgDObM=
Rpe+BrGBzpGa9q8FHKpi
/WmW2322D7fNRPTILa58Juqk/ZM=
+RXDz2RnrG6J
G2uU9LualUtez4NigNITbgyuIybyPzM=
edeuu22xD1rTFu+ci/JLpyGuIybyPzM=
pP8hbRJZqelZrXS+HWDm+H+g
8STQ6HSb4lE4XmOOvw==
hr/lDpXMc4jYF/80
zQ/HzrVdryLZMvhEZ+Y=
HV4gPCecmZPFL8v1N6x1
LEf38qRZvLgqVfTXPa19
7euZ5pxpp2ZtrYb1N6x1
iqU5LgL782FBXmOOvw==
gtbwN+MldLRNoQZhh8l/
WUgMbA3KHBFYvlM6xk7m+H+g
b1zuBfz/FgrL92U4
Q6jeIxKBj5a+66DmTJCE7LZkK/eC/Q==
5BnV1pTXMa+W8aXGFVdhe4GQhg==
0UIRgvizzg8=
Cf/BDgD1/4JpqGQveZhw
+SPb0ojBEZzzTLk=
1ihEmlgPYYcJPPhEZ+Y=
va9ioKotR8gDObM=
66NR6ZvZGVfLLgOkSXLm+H+g
s7Ftp5/JE9zxPsv1N6x1
OZjAEbHmQr57flVNog==
SWYQJhbPGKdlXmOOvw==
D2UxQCXKFoVIoSu9IHUrWw==
ISLrKBL7AbPbCiJc5FAkMhM=
yhErdYm07KzDN9oFHKpi
vL5nTlhRf7GT9w==
p/wcbinhJe3eP90FHKpi
JCG1tJvLI+MUMwHVtw==
YKGzBi9gqWJ7tXgqW9cve4GQhg==
GzDd8t2F3lM7nzQw0Urm+H+g
gHo/fQEoa6tAVjiEqA==
zQ7U6cY1RYcJPPhEZ+Y=
BEEFEwEwYhkxlEUD+TMJnhs=
wfubpSsNjM5t4sOGqWbFp+K6pc/n9Q==
NntHSf0ybNuawX/q4Blh68nzK/eC/Q==
BVRywXVfdfjPK+DImLD3SQBQ2Js=
pOOyL/izzg8=
2c2Sxo8iuKv0L78=
wRU0iU8CRLSS9Q==
+Sjk78IvKRNv364HcZ4l+bAXxhes
pauloeamanda.com
Targets
-
-
Target
Swift_049949_pdf.js
-
Size
356KB
-
MD5
f01befe67328d6895946ab4c8763f006
-
SHA1
b302694c2c69da517b88eec771d8fc2c13ad5a66
-
SHA256
4a9a8778e84343f5992bddbfdec6e7d45ca399d1f20a44bcb8eaccd05372f193
-
SHA512
012fd72d8a70023772345213fdefb6382e4658e97bfd27cd4610312e4aa7fd113bde436f159451b77688ca876401cd05b2a207d194a3e562b265fbcdfb0a17a4
-
SSDEEP
6144:BWCdn1qRUAtmWXwXXJ528/RpFH81oTrmYW1XEMnGWrUvfhZN8gkU9uQyp:BbqZmWXsXzLH981omYHMGWuZZOrU+p
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-