Overview

overview

7

Static

static

3

Vivek_orde...ls.lnk

windows7-x64

3

Vivek_orde...ls.lnk

windows10-2004-x64

7

Vivek_orde...ls.pdf

windows7-x64

1

Vivek_orde...ls.pdf

windows10-2004-x64

1

assets.dll

windows7-x64

1

assets.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    15022024_0218_vivek_support.iso

  • Size

    598KB

  • MD5

    6c7f878c8af9a545f73d393d26d5b32b

  • SHA1

    74230a6688892bc6522fd0092e32fed7e37f585b

  • SHA256

    e83ecb903a0693682ef53c2c4599270479de432a479df8965e1082a7f434ffa0

  • SHA512

    d0d326a382878d7647e4e5396659b13cfa9b6e297f55ab12779efd09514ee0122b729ea1dc3be6fd1bfb3f0ba61fffa720977676ebe8181ef7430622d9693e7d

  • SSDEEP

    12288:vqYm+9lEcNv2Ts14oeh0cSxUwqdFfwL0p8PcbEYlKjwEUW0t:vY+lECeTs147h0coUpyu8PcbEYkvTG

Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 15022024_0218_vivek_support.iso
    .iso .pdf polyglot

    Password: infected

  • out.iso
    .iso .pdf polyglot

    Password: infected

  • Vivek_order_details.lnk
    .lnk
  • Vivek_order_details.pdf
    .pdf

    Password: infected

    • http://proton.me

  • assets.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    Password: infected

    c521a6c48bda8600d859bd3647afd5ea


    Headers

    Imports

    Exports

    Sections