6cf19d7eee4ff4da8a79fb8dab15f99e.bin
- SHA256 13359f410a45b46e21b37640edb1fabe71d44f503425b019406cd4d8e1d15d5d
Password
infected
Overview
overview
8Static
static
61ad4e8a666...bf.ps1
windows7-x64
81ad4e8a666...bf.ps1
windows10-2004-x64
88f8264c173...42.pdf
windows7-x64
18f8264c173...42.pdf
windows10-2004-x64
1a5c406f287...65.exe
windows7-x64
a5c406f287...65.exe
windows10-2004-x64
b7b62436f1...63.elf
debian-9-armhf
1c897c78462...6f.dll
windows7-x64
1c897c78462...6f.dll
windows10-2004-x64
1f1b2760487...39.exe
windows7-x64
f1b2760487...39.exe
windows10-2004-x64
f28ca28920...b1.exe
windows7-x64
1f28ca28920...b1.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063.elf
Resource
debian9-armhf-20231222-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 6cf19d7eee4ff4da8a79fb8dab15f99e.bin
- Size 374KB
- Sample240110-df1afadfg9
- SHA256 13359f410a45b46e21b37640edb1fabe71d44f503425b019406cd4d8e1d15d5d
- MD5 6cf19d7eee4ff4da8a79fb8dab15f99e
- SHA1 3eb3ab9d77c3d7f090a53901f39763c5982e5873
- SHA512 3a2cf7a10d85cf0c89ed2c721c7c7da2c88934ab35bf03e6848b9fc1d2177211e0bd42bc68a0d819999e974e4c22caac95ae51017deba24dd777573a64ef1ba6
- SSDEEP 6144:pujyZxTqLQsg6aR54kuBceXEr74grSV17hRQSlneWt2NFnBIyPj:Qe7T96dZXw4g45/QSlefNFnqyr
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- PDF contains JavaScript
Detects presence of JavaScript in PDF files.
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll unpack001/f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe
File Explorer
-
6cf19d7eee4ff4da8a79fb8dab15f99e.bin.zip 374KB
-
1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1.ps1 1KB
-
40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd.unknown44KB
-
8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf.pdf 50KB
-
a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe184KB
-
b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063.elf.elf 12KB
-
c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll.dll 3KB
-
f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe164KB
-
f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe.exe 100KB
1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1
- SHA256 1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf
- MD5 642f66c6c6b7cfbe0da921ea030df0cb
- SHA1 999a425666dad19c246db0775b9cec8d930b40a2
- SHA512 d6f26e731d4415ccfae089c713e7865268532ae8a82c1fd75c9228451fdde33b6e4c6c264fdd7cd807ae06b53ad0265bf6034c7c4c51f3db83b323edad9cba42
- MD5 SHA1 SHA512
40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd.unknown
- SHA256 40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd
- MD5 988b428aa7da930315d2bdac1d7f13f7
- SHA1 3fbd69f9611a6c2181f9decb7d62a19d12bf97ee
- SHA512 0078fd9e69e2f9e172de2db3dc3d13c1b7fcdebc9ef95783d89f3491b248a87c1f0264afcaaf9c7cac53b8ff10ec4e07057bfe86749010a2092c600cc3e9048f
- SSDEEP 768:YNbvbVqraag0YrBHXZUrRhSZOh/q+wjDp8v3uWqeqLhy5:YlDsraDD1HJ+94jDS/XqeqVy5
- MD5 SHA1 SHA512 SSDEEP
8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf
- SHA256 8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242
- MD5 3c218594fe3db33cff5c3d4dc7b5b14c
- SHA1 f7c625f1d3581aa9a3fb81bb26c02f17f0a4004e
- SHA512 a881a1bb9ad3cbe26f6de6feddac5733a14899f48ae275dbc879e40744c3ee0cdcbcf8223b356b8ad43d02624b606721af855de030c567616f67efa3f177f530
- SSDEEP 384:2cSDvX7hWFcTPm/K7Uzzzzzzzzzzzzzzzzz32cm8:2cST7hWGTO/Kr8
- MD5 SHA1 SHA512 SSDEEP
Password
infected
a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe
- SHA256 a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65
- MD5 c20f7442c6d95afcd1f22cde88418cc5
- SHA1 26b849021350124f9ef541767b08a46e02fd0401
- SHA512 5322437d061aa20f92b1068e337ec383e1432e826231411ea5c174940cbe6238154df39b3ec7e864c30a1f42a933468588a42e2eb8166e4ebd367aea1fe72fec
- SSDEEP 3072:YB82tUdBGMwLBEBNlGlyBgj6Jag3/izWNV+ewE5JswPGIUh8w9U0TMZ:v22zGMSqNsg683/izWn++rUd9U0Tm
- MD5 SHA1 SHA512 SSDEEP
b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063.elf
- SHA256 b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063
- MD5 b8877fd584233abcb14c948ef9cdf543
- SHA1 e82dbda2f45da6817c8b6629e712d27a485375a4
- SHA512 bd2d7b0e45149cf456159de7ea5141299afc423680084345ff118832a813659758ce5ca075ea3195724fe8f357aa5bc626cf54f11d948c781685b2d8a2f63b2e
- SSDEEP 192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdv4:yb2eX3zAKuiNPZRwwqdv4
- MD5 SHA1 SHA512 SSDEEP
c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f
- MD5 a67b4a881e940f82fe871505f831bf96
- SHA1 ffcd7a3a80eb0caf019a6d30297522d49311feec
- SHA512 9c33174f4867b1d01c537425a40e3e0d290559d8777e6cc9a9e77a907067ecabeb11fe96322081ce56b381913d24ecce2020dac901bef89fc9fe66e0e28c0742
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
9582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe
- SHA256 f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439
- MD5 15e7b48f42f2f554af59273624a1c963
- SHA1 40d258058bd0da133d18eef25c518ee2822bf820
- SHA512 401764aacf6383a2402bc52ff86f8d2d330ceb15ae7a9d6cdb6e5d0ce1fe5975ef0aaa7592e98adcaaa2c2959cef7f608a4911af9341f3d21bf9b5a8456aa78d
- SSDEEP 3072:Uyc7yw8ntQBkNhSys+LTUUMc5Q0hPjfr1bKMbyAvvvvvvvvvvvvvv0NUFSe+E:Uycuwi7NhsaTUUMc20NzrVKMufu4E
- MD5 SHA1 SHA512 SSDEEP
f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe
- IMPHASH 5fb55a8cf9e366e92e6438ce6e27e358
- SHA256 f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1
- MD5 a4f5440b7f44e289fd8d5cc3cc16c359
- SHA1 7507fe6c69ac054b3621b3d1df45f5d54a0bd57d
- SHA512 38af98b32b18f064aa32ff9cfb59f0446eb29f445e145c1870bc531fa9d829e32a63e262f741c443337e39bd550c4c68b76d235bce0ec783177d9cab73bf03b1
- SSDEEP 1536:93L1yHnz19CDUJKLqtABd+wFa2L1swXLCCGX3cH3:93L1O5kwJKWiBkQLTXZGg3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
6084
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
ord588
__vbaLenBstr
__vbaStrVarMove
__vbaLineInputStr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaResume
__vbaCopyBytes
__vbaStrCat
__vbaError
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
ord558
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaLateMemSt
ord593
__vbaVarForInit
__vbaExitProc
__vbaForEachCollObj
ord594
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaFpR4
__vbaBoolVar
__vbaStrFixstr
ord520
__vbaFpR8
_CIsin
ord709
__vbaErase
ord631
ord525
ord632
__vbaNextEachCollObj
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
DllFunctionCall
ord563
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
ord601
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
ord712
__vbaStrToUnicode
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
ord531
__vbaFPException
ord717
__vbaInStrVar
__vbaGetOwner3
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
__vbaI2Var
__vbaLsetFixstrFree
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVar2Vec
__vbaVarLateMemCallLdRf
ord570
__vbaNew2
ord648
ord571
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
ord573
__vbaStrCopy
ord681
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaFpI4
ord616
__vbaVarLateMemCallLd
__vbaVarCopy
ord617
__vbaVarSetObjAddref
__vbaLateMemCallLd
__vbaR8IntI2
__vbaRecDestructAnsi
_CIatan
ord618
__vbaAryCopy
__vbaStrMove
__vbaStrVarCopy
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaMidStmtBstr
__vbaFreeStr
__vbaFreeObj
__vbaRecAssign
ord581
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=2, id=9, version=8041,
count=1, id=13, version=8169,