Overview

overview

7

Static

static

1

DHL ORIGIN...df.exe

windows7-x64

7

DHL ORIGIN...df.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    DHL ORIGINAH INVOICE_pdf.exe

  • Size

    260KB

  • Sample

    230329-jmjh6aha2s

  • MD5

    6ddfa3ae8f08785383dab866c47a155f

  • SHA1

    822faf00e2e055b76b388f4c2ca2661fee94f3fc

  • SHA256

    651db78cf227322aa6d3f4ec967eebe97d0cc9bb26a39a06efd143e0e093208d

  • SHA512

    2dfb48f7bad924464fe8871ea4b52cba714ab7f253ffe47a21836d144fabf6becdfb0ea041cf99af1e48f1f6bdf844648ab7ff238bceb8d3ed1109c93d40e719

  • SSDEEP

    6144:PYa6vUH5p23AlZTs6KxWB3bYTAIptYhyOG+tl50rbGsa6kgo:PY9gp24tKxWB3MTAAtoG+tl50nGF3go

Score
7/10

Malware Config

Targets

    • Target

      DHL ORIGINAH INVOICE_pdf.exe

    • Size

      260KB

    • MD5

      6ddfa3ae8f08785383dab866c47a155f

    • SHA1

      822faf00e2e055b76b388f4c2ca2661fee94f3fc

    • SHA256

      651db78cf227322aa6d3f4ec967eebe97d0cc9bb26a39a06efd143e0e093208d

    • SHA512

      2dfb48f7bad924464fe8871ea4b52cba714ab7f253ffe47a21836d144fabf6becdfb0ea041cf99af1e48f1f6bdf844648ab7ff238bceb8d3ed1109c93d40e719

    • SSDEEP

      6144:PYa6vUH5p23AlZTs6KxWB3bYTAIptYhyOG+tl50rbGsa6kgo:PY9gp24tKxWB3MTAAtoG+tl50nGF3go

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks