Overview

overview

10

Static

static

10

12102023_2...su.pdf

windows7-x64

1

12102023_2...su.pdf

windows10-2004-x64

1

tek.exe

windows7-x64

10

tek.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    12102023_2346_02102023_yatirimtablosu.pdf

  • Size

    74KB

  • MD5

    ae198a1fafc46ac68d899dfbba0ccec4

  • SHA1

    33ede1342ec0cc7731f2f9e4c8763336f52bc4f6

  • SHA256

    0f9593cc1f575e0faa4f394bc1f37f09b749afd50cc2c17bedb0f979368d7a6f

  • SHA512

    26959c69dd0f4633d214012b4449a021acf266eaa4dcdf03c1b2e37277dcf2b0f44687c5594f10bf14563bcc0f9800807cec524ef74e1f5c18710b782680bdff

  • SSDEEP

    1536:ULpNVmFhV8CEswjWF31DHX/CuR+bPp4QCQoEOtgCrU/BG/jh5meQO0:ucFh4uDvCV4QPobtcMCeQN

Score
10/10
pdfjavascriptmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

194.180.50.158:4444

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 12102023_2346_02102023_yatirimtablosu.pdf
    .pdf

    Password: infected

  • tek.pdf
    .exe windows:4 windows x86

    Password: infected

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections