Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Potwierdzenie operacji iPKO biznes 2023.09.26.pdf.exe
-
Size
1.2MB
-
Sample
231011-r2b2mafe44
-
MD5
c8a0fcff0f8f92d80e1a7d855c7d8b48
-
SHA1
04cff1587def4668543115a515f90d90fdb19331
-
SHA256
43a98f8be897de5d3fd626871ae8d3a4add5461ddd09ec83db27c8ec5e6d793e
-
SHA512
66158e30a0920862a52eec827ae0f960cacef5012d6168f21b2d692b0e18d2d340cea92d39879deb1cf9484b4ba0da85aa5037f33cb53903c17605ce7f517f86
-
SSDEEP
24576:L3izvEECMDCEYRhIHHzzdPKM07dwCIg9ad15BLEQlD/I2:L3NEfzHzBPP076Ct9U15BAQlD/I2
Static task
static1
Behavioral task
behavioral1
Sample
Potwierdzenie operacji iPKO biznes 2023.09.26.pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Potwierdzenie operacji iPKO biznes 2023.09.26.pdf.exe
Resource
win10v2004-20230915-en
Malware Config
Targets
-
-
Target
Potwierdzenie operacji iPKO biznes 2023.09.26.pdf.exe
-
Size
1.2MB
-
MD5
c8a0fcff0f8f92d80e1a7d855c7d8b48
-
SHA1
04cff1587def4668543115a515f90d90fdb19331
-
SHA256
43a98f8be897de5d3fd626871ae8d3a4add5461ddd09ec83db27c8ec5e6d793e
-
SHA512
66158e30a0920862a52eec827ae0f960cacef5012d6168f21b2d692b0e18d2d340cea92d39879deb1cf9484b4ba0da85aa5037f33cb53903c17605ce7f517f86
-
SSDEEP
24576:L3izvEECMDCEYRhIHHzzdPKM07dwCIg9ad15BLEQlD/I2:L3NEfzHzBPP076Ct9U15BAQlD/I2
Score7/10-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-