Overview

overview

7

Static

static

6

cbc3bd1c1d...da.pdf

windows7-x64

4

cbc3bd1c1d...da.pdf

windows10-2004-x64

1

s7-300_IHB_f.exe

windows7-x64

7

s7-300_IHB_f.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    cbc3bd1c1d5d3bdc10ea0cfc9c487fda

  • Size

    10.5MB

  • MD5

    cbc3bd1c1d5d3bdc10ea0cfc9c487fda

  • SHA1

    6459d3f92edf30ee1ba8b69aaea260347bfe0276

  • SHA256

    cf31aa18b690894c45382ef3321ff3106541906c7acb2290e61b3f009e4c4a7e

  • SHA512

    701799e0f0b1db0394d3b1d4ab8f84c7d7cfe5dffbb79dfa03bfe38939a7a6c4d7848f0f3ac553452fd7cbb3dc4df4b3d0724072b2e0865648ef19105e5e3e75

  • SSDEEP

    196608:9cs6BHpoxWqL8PIuf/YXYO16FRhJuq8VDFzNqz0L4YCIjhPPrrfUJL:9cnHpYWqL8rYMuq8V9Nqz0UL+hH8JL

Score
6/10
pdflinkjavascriptpyinstaller

Malware Config

Signatures

  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cbc3bd1c1d5d3bdc10ea0cfc9c487fda
    .pdf

    • http://www.siemens.com/automation/partner

    • http://www.sitrain.com

    • http://www.siemens.com/automation/service&support

    • http://www.ad.siemens.de/csinfo

    • http://www.ad.siemens.de/csi/gsd

    • http://www.ad.siemens.de/simatic-cs

    • http://siemens.com

    • http://sea.siemens.com

    • http://adsupport.asia

    • Show all
  • s7-300_IHB_f.pdf
    .exe windows:5 windows x64 arch:x64

    e1e8417f4591da7741a300229f9e8e8b


    Headers

    Imports

    Sections

  • stopAutomatesProp.pyc