ad3262a7c90b9bca6b93019e968110d22947aa2f3b460ab1ddaec6cc0d68b5c1 | Triage

Sharing

General

Target

454bda3c47130e9f150b73980beebe7e
Size

1.6MB
Sample

240106-e69r8saaf3
MD5

454bda3c47130e9f150b73980beebe7e
SHA1

6d2138142569911925e1f6c37df8d034192ca039
SHA256

ad3262a7c90b9bca6b93019e968110d22947aa2f3b460ab1ddaec6cc0d68b5c1
SHA512

e3b3dec27f877660c31bb9d968bc558d64b999c0fddd0ae9b2a25e224238a6e53b9476bd6a5ab55024ed08085919d31801556d537b4c6a773dc0c19fdfabf70e
SSDEEP

24576:5WBlI4gAviQo9KASCGnnWgIET1VnhGd7d8vwn3g7OPWjaMckypl3b+K7ozXFm:5MlIevao3jTZG/8vy6RaMVyL3KrFm

Score

7^/10

Malware Config

Targets

- Target
  
  PdfFactory.Pro.exe
- Size
  
  1.7MB
- MD5
  
  d4a23c2e0aa8aa0bfae582a5c4d498d4
- SHA1
  
  9e3fe73900dae0292fd45f179f1c3555bab36667
- SHA256
  
  5e186433f8dca1e68a791d9bfdb039711fb6df7af51e6405ecc64b00d1ed4591
- SHA512
  
  5fb0c52656f8f6c516d170eb2395531960f57a5f1882f6e2337f61bde21c0d34b6e99f218f70f957bae27497d71f521b6cc0102d16ce4ca72a2e4aae1c79480e
- SSDEEP
  
  49152:mklHgDdD+IEVFA5KhmmSxDqg2ZHpttf27Drvu:xHgMVS5KMmSMttgrvu
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  新云软件.url
- Size
  
  133B
- MD5
  
  4f0017b3b346bd0626f0c3b915e6e734
- SHA1
  
  823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA256
  
  df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- SHA512
  
  0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
Score

1^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4