Behavioral task
behavioral1
Sample
NEAS.6fdf04bb59371ba68bbb620c5d1eee10.pdf
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.6fdf04bb59371ba68bbb620c5d1eee10.pdf
Resource
win10v2004-20231020-en
General
-
Target
NEAS.6fdf04bb59371ba68bbb620c5d1eee10.pdf
-
Size
8.2MB
-
MD5
6fdf04bb59371ba68bbb620c5d1eee10
-
SHA1
acc42fb6312b5b1a191bfe5dd9de458438409ecb
-
SHA256
398dc17d01078c3c823e8516ba2e4f36c2010d9fd5c972dc5eb4e6a6f8aeea43
-
SHA512
3fca0142cf5ac305fee34cbc32271c00a22a5168436a558a04f4d5c0b9618f5006359d63c04bfab2c41d88d01d4d9a2745d197599ce43486e358cbd7858c7761
-
SSDEEP
196608:Y2Q0grnO1v+wE9B75yvBwpDhLZRWU2adHEyfgtMA:JQ0grOV+NB8vBiZRDlfgtT
Malware Config
Signatures
Files
-
NEAS.6fdf04bb59371ba68bbb620c5d1eee10.pdf.pdf
-
https://ping.force.com/s/PingFederate-help
-
http://www.oracle.com/technetwork/java/javase/downloads/index.html
-
https://www.pingidentity.com/en/account/request-license-key.html
-
https://www.pingone.com
-
https://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf
-
https://www.oasis-open.org/committees/download.php/3406/oasis-sstc-saml-core-1.1.pdf
-
https://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html
-
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=ws-sx
-
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss
-
https://tools.ietf.org/html/rfc6749
-
https://tools.ietf.org/html/rfc7636
-
https://openid.net/connect/
-
https://tools.ietf.org/html/rfc7591
-
http://www.simplecloud.info/
-
https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf
-
https://tools.ietf.org/html/rfc7522
-
https://www.pingidentity.com/en/resources/downloads.html
-
https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-
https://logging.apache.org/log4j/2.x/manual/index.html
-
https://splunkbase.splunk.com/
-
https://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/HowtoforwarddatatoSplunkEnterprise
-
https://www.splunk.com/en_us/download/universal-forwarder.html
-
https://velocity.apache.org
-
https://www.pingidentity.com/support/
-
https://tools.ietf.org/html/bcp47
-
https://docs.oracle.com/javase/8/docs/api/java/util/Locale.html#forLanguageTag-java.lang.String-
-
http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
-
https://docs.pingidentity.com/bundle/ix_m_downloadDocumentation/page/ix_c_pingdirectoryDocumentationArchive.html
-
https://docs.oracle.com/cd/E29127_01/doc.111170/e28974/security-requirements.htm#aalhm
-
https://msdn.microsoft.com/library/cc223358.aspx
-
https://tools.ietf.org/html/rfc4370
-
https://support.twilio.com/
-
https://tools.ietf.org/html/rfc7518
-
https://tools.ietf.org/html/rfc7517
-
https://tools.ietf.org/html/rfc2560
-
https://www.incommon.org/participants
-
https://documentation.pingidentity.com/pingid/pingidAdminGuide/index.shtml#integratingPingIDWithYourVPN.html
-
https://documentation.pingidentity.com/pingone/employeeSsoAdminGuide/#userDirManagement.html
-
https://documentation.pingidentity.com/pingone/employeeSsoAdminGuide/#directoryCredentials.html
-
https://tools.ietf.org/html/rfc2181#section-10
-
https://freeradius.org/radiusd/man/dictionary.html
-
https://technet.microsoft.com/en-us/library/cc773178(v=ws.10).aspx
-
https://msdn.microsoft.com/library/hh869301.aspx
-
https://www.w3schools.com/tags/ref_urlencode.asp
-
https://www.w3.org/TR/cors
-
https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication
-
https://tools.ietf.org/html/draft-ietf-oauth-mtls-01
-
https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Combinations
-
https://openid.net/specs/openid-connect-core-1_0.html#Authentication
-
https://docs.pingidentity.com/bundle/pa_sm_APIManagement_pa51/page/pa_c_OpenID_Connect_Endpoints.html
-
https://tools.ietf.org/html/rfc7523
-
https://docs.pingidentity.com/bundle/SaaSQuickConn_sm_QuickConnectionGuide/page/saasQuickConn_c_saasQuickConnectionGuide.html
-
https://tools.ietf.org/html/rfc4524
-
https://tools.ietf.org/html/rfc4519
-
https://www.ldap.com/ldap-oid-reference
-
http://www.oid-info.com/
-
https://www.w3.org/TR/xmlenc-core/
-
https://admin.pingone.com
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#edit-resource-with-patch
-
http://www.simplecloud.info/specs/draft-scim-core-schema-01.html
-
https://support.microsoft.com/kb/305144
-
https://www.pingidentity.com/en/resources/downloads/pingfederate.html
-
https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#delete-resource
-
https://openid.net/specs/openid-connect-core-1_0.html#RequestObject
-
https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin
-
https://docs.oasis-open.org/wss-m/wss/v1.1.1/os/wss-SAMLTokenProfile-v1.1.1-os.html
-
https://www.oasis-open.org/standards
-
https://docs.pingidentity.com/category/token_translators
-
https://www.w3.org/TR/2000/NOTE-SOAP-20000508/#_Toc478383507
-
https://documentation.pingidentity.com/pingid/pingidAdminGuide/index.shtml#pingidPFoverview.html
-
https://technet.microsoft.com/en-us/library/dd378897%28v=ws.10%29.aspx
-
https://documentation.pingidentity.com/pingone/employeeSsoAdminGuide/#enableAppFromCatalog.html
-
https://documentation.pingidentity.com/pingone/employeeSsoAdminGuide/#groupManagement.html
-
https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-
http://www.simplecloud.info/specs/draft-scim-api-01.html
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#query-resources
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#rfc.section.3.2.2.1
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#rfc.section.3.2.2.2
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#rfc.section.3.2.2.3
-
http://www.simplecloud.info/specs/draft-scim-api-01.html#anchor6
-
https://docs.microsoft.com/en-us/dotnet/framework/wcf/system-provided-bindings
-
https://msdn.microsoft.com/library/ff423674.aspx
-
https://tools.ietf.org/html/rfc4648
-
https://tools.ietf.org/html/rfc6749#section-3.2
-
https://tools.ietf.org/html/rfc7521#section-4.2
-
https://tools.ietf.org/html/rfc6749#section-3.1
-
https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html
-
https://tools.ietf.org/html/rfc7523#section-2.1
-
https://tools.ietf.org/html/rfc4648#section-5
-
https://tools.ietf.org/html/rfc7662
-
https://tools.ietf.org/html/rfc7009
-
https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
-
https://openid.net/specs/openid-financial-api-part-2.html
-
https://javaee.github.io/javaee-spec/javadocs/javax/servlet/http/HttpServletRequest.html
-
https://docs.oracle.com/javase/8/docs/api/java/security/cert/X509Certificate.html
-
https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html
-
https://docs.oracle.com/cd/E29127_01/doc.111170/e28967/ismemberof-5dsat.htm
-
https://www.telerik.com/fiddler
-
https://www.charlesproxy.com/
-
https://www.wireshark.org/
-
https://www.tcpdump.org/
-
https://msdn.microsoft.com/library/ms676900.aspx
-
http://jgroups.org/manual/index.html#Transport
-
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html
-
https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
-
https://docs.aws.amazon.com/AmazonS3/latest/gsg/CreatingABucket.html
-
https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys
-
http://jgroups.org/manual/index.html#FILE_PING
-
http://jgroups.org/manual/index.html#_swift_ping
-
https://docs.pingidentity.com/category/ik
-
https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests
-
https://tools.ietf.org/html/rfc7523#section-2.2
-
https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
-
https://issues.jboss.org/browse/JGRP-1922
-
https://www.pingidentity.com/en/resources/downloads/pingfederate/platform.html
-
https://www.pingidentity.com/en/resources/downloads/pingfederate/upgrade.html
-
https://ping.force.com/Support/PingIdentityArticle?id=kA340000000L5MyCAK
-
https://docs.oracle.com/javase/8/docs/technotes/guides/vm/gctuning/
-
http://www.oracle.com/technetwork/java/javase/tech/vmoptions-jsp-140102.html
-
http://startSLO.ping
-
http://writecdc.ping/pf/idprofile.ping/pf/id/verification.ping
-
http://defederate.ping/sp/cdcstartSSO.ping/sp/startAttributeQuery.ping
-
http://heartbeat.ping/pf/adapter2adapter.ping
-
http://oauth_access_grants.ping
-
http://startSSO.ping
- Show all
-