Behavioral task
behavioral1
Sample
458f81004992ebdee22d4a3fe58b36be7ece2ac240a528f562a0513353a63107.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
458f81004992ebdee22d4a3fe58b36be7ece2ac240a528f562a0513353a63107.pdf
Resource
win10v2004-20240221-en
General
-
Target
458f81004992ebdee22d4a3fe58b36be7ece2ac240a528f562a0513353a63107
-
Size
9.1MB
-
MD5
1aefaabe2048a4c831227be3d3e1386a
-
SHA1
e3e7665aea60a380a5de10f5fa5f0d97249d3f2a
-
SHA256
458f81004992ebdee22d4a3fe58b36be7ece2ac240a528f562a0513353a63107
-
SHA512
020c01a24b26ce37705c2ccd674b8b46de58a6c9ce215cdcf18601d2b3cd93c8e17abce83921721f53148f4fada8c03fa72a5a3654279de250792a672903b2c9
-
SSDEEP
196608:qSRS+SeFzF8xtITQiLOs0j8eANNzzNS3ohVM6:8+pFzNcJjpA/0wVf
Malware Config
Signatures
Files
-
458f81004992ebdee22d4a3fe58b36be7ece2ac240a528f562a0513353a63107.pdf
-
http://nostarch.com
-
http://www.nostarch.com
-
http://...............................................................................................xxx
-
http://www.informit.com/articles/article.aspx?p=1686289
-
http://git.gnome.org/browse/gedit/tree/gedit?id=3.3.1
-
http://dl.packetstormsecurity.net/papers/virus/Sophail.pdf
-
http://www.practicalmalwareanalysis.com
-
http://www.nostarch.com/malware.htm
-
http://www.virustotal.com
-
http://bit.ly/ic4plL
-
http://upx.sourceforge.net
-
http://www.dependencywalker.com
-
http://program.data
-
http://www.angusj.com
-
http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html
-
http://www.heaventools.com
-
http://www.VirusTotal.com
-
http://www.VirusTotal.com/.
-
http://www.mandiant.com/products/research/mandiant_apatedns/download
-
http://evil.malwar3.com
-
http://www.google.com
-
http://www.malwareanalysisbook.com
-
http://0.je
-
http://performed.jo
-
http://program.int
-
http://www.intel.com/products/processor/manuals/index.htm.
-
http://www.hex-rays.com/idapro/idadownfreeware.htm,
-
http://Lab05-01.py
-
http://function.int
-
http://operation.int
-
http://statements.int
-
http://0.int
-
http://loop.int
-
http://is0.int
-
http://conventions.int
-
http://printf.int
-
http://code.int
-
http://name.sa
-
http://undocumented.ntinternals.net
-
http://www.openrce.org/downloads/browse/OllyDbg_Plugins.OllyDbg
-
http://malwareanalysisbook.com
-
http://msdl.microsoft.com/download/symbolsThe
-
http://www.poisonivy-rat.com
-
http://www.metasploit.com
-
http://s.2.ga
-
http://www.opinionatedgeek.com/dotnet/tools/base64decode/.
-
http://www.openssl.org/support/faq.html%s
-
http://openssl.org
-
http://www.hex-rays.com/idapro/freefiles/findcrypt.zip
-
http://www.peid.has.it
-
http://www.smokedchicken.org/2010/06/ida-entropy-plugin.html
-
http://www.dlitz.net/software/pycrypto/
-
http://DES.new
-
http://f.read
-
http://cfile.read
-
http://imm.read
-
http://www.badsite.com
-
http://www.yahoo.com
-
http://www.domaintools.com
-
http://www.robtex.com
-
http://www.bfk.de/bfk_dnslogger_en.html
-
http://www.threatexpert.com/report.aspx?md5=d9bcb4e4d650a6ed4402fab8f9ef1387;
-
http://doc.emergingthreats.net/2010262;
-
http://www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_WindowsEnterpriseFakeAV;
-
http://www.thepasswordisflapjack.maliciousdomain.com
-
http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
-
http://www.w3.org/1999/xhtml
-
http://www.example.com/fast.execnVuOnd3dy5leGFtcGxlLmNvbS9mYXN0LmV4ZQ==Download
-
http://www.example.com:80
-
http://sf.net/projects/bastard/files/libdisasm/
-
http://check.mov
-
http://16-6.call
-
http://processentry32.sz
-
http://www.trapkit.de
-
http://findAntiVM.py
-
http://Section.data
-
http://undocumented.ntinternals.net/.Figure
-
http://va.search
-
http://www.mindviewinc.com/.In
-
http://arg.foo
-
http://address.int
-
http://www.mandiant.com/.AutorunsAutoruns
-
http://www.sysinternals.com/.BinDiffBinDiff
-
http://www.zynamics.com/.BinNaviBinNavi
-
http://www.zynamics.com/.
-
http://bochs.sourceforge.net/.
-
http://www.hex-rays.com/products/ida/debugger/bochs_tut.pdf.Burp
-
http://portswigger.net/burp/.Capture
-
http://www.honeynet.org/.CFF
-
http://www.ntcore.com/.Deep
-
http://www.faronics.com/.
-
http://www.dependencywalker.com/.Hex
-
http://www.hex-rays.com/.
-
http://www.hex-rays.com/products/ida/support/download_freeware.shtml.Immunity
-
http://www.immunityinc.com/.Import
-
http://tuts4you.com/download.php?view.415.
-
http://www.inetsim.org/.LordPELordPE
-
http://www.woodmann.com/collaborative/tools/index.php/LordPE.Malcode
-
http://labs.idefense.com/software/download/?downloadID=8.MemoryzeMemoryze
-
http://www.mandiant.com/.NetcatNetcat,
-
http://joncraton.org/media/files/nc111nt.zip.OfficeMalScannerOfficeMalScanner
-
http://www.reconstructer.org/.OllyDbgOllyDbg
-
http://www.ollydbg.de/.OSR
-
http://www.osronline.com/.PDF
-
http://www.zynamics.com/.PDF
-
http://pdfid.py
-
http://pdf-parser.py
-
http://blog.didierstevens.com/programs/pdf-tools/.PE
-
http://www.heaventools.com/.PEiDPEiD
-
http://www.peid.info/.
-
http://www.magma.ca/~wjr/.
-
http://www.sysinternals.com/.Process
-
http://processhacker.sourceforge.net/.Process
-
http://www.sysinternals.com/.PythonThe
-
http://www.python.org/.RegshotRegshot
-
http://sourceforge.net/projects/regshot/.Resource
-
http://www.angusj.com/resourcehacker/.
-
http://www.sandboxie.com
-
http://bsa.isoftware.nl/.SnortSnort
-
http://www.snort.org/.
-
http://www.sysinternals.com/.TCPViewTCPView
-
http://www.sysinternals.com/.The
-
http://www.sleuthkit.org/.
-
http://whatismyipaddress.com
-
https://www.torproject.org/.TrumanTruman
-
http://www.secureworks.com/research/tools/truman/.WinDbgWinDbg
-
http://msdn.microsoft.com/.WiresharkWireshark
-
http://www.wireshark.org/.UPXUltimate
-
http://upx.sourceforge.net/.
-
http://www.offensivecomputing.net/.
-
http://www.virustotal.com/.VMware
-
http://www.vmware.com
-
http://code.google.com/p/volatility/.YARAYARA
-
http://code.google.com/p/yara-project/.Zero
-
http://zerowine.sourceforge.net/.
-
http://VirusTotal.com
-
http://www.malwareanalysisbook.com/.Detailed
-
http://www.malwareanalysisbook.com/updater.exe
-
http://www.malwareanalysisbok.com/updater.exe,
-
http://practicalmalwareanalysis.com
-
http://pics.practicalmalwareanalysis.com
-
http://pics.pracitcalmalwareanalysis.com
-
http://www.practicalmalwareanalysis.com/cc.htm
-
http://www.practicalmalwareanalysis.com/cc.htm.6.First,
-
http://www.practicalmalwareanalysis.com/cc.htmInternet
-
http://www.practicalmalwareanalysis.com/cc.htm.
-
http://www.malwareanalysisbook.com/,
-
http://www.malwareanalysisbook.com/ad.html.
-
http://www.malwareanalysisbook.com/ad.html.After
-
http://www.practicalmalwareanalysis.com/;
-
http://xxxx.xxx
-
http://www.practicalmalwareanalysis.com/.The
-
http://www.x-ways.net/winhex/
-
http://www.practicalmalwareanalysis.com/updater.exe.
-
http://custom_b64_decrypt.py
-
http://AES.new
-
http://aes_decrypt.py
-
http://www.practicalmalwareanalysis.com/%s/%c.pngThis
-
http://www.practicalmalwareanalysis.com/start.htm.
-
http://www.practical0820201637000023232338161801032009030112malwareanalysis.com/start.htm130112230118050114011225190919380315130019200118203808201314
-
http://www.practicalmalwareanalysis.com/bamboo.html.
-
http://www.practicalmalwareanalysis.com/bamboo.html,
-
http://www.practicalmalwareanalysis.com/bamboo.html
-
http://www.practicalmalwareanalysis.com/tt.html.4.The
-
http://www.practicalmalwareanalysis.com/tt.html
-
http://www.woodmann.com/collaborative/tools/index.php/PhantOm
-
http://adg.malwareanalysisbook.com
-
http://newsnews.practicalmalwareanalysis.com
-
http://pe.sz
-
http://www.practicalmalwareanalysis.com/shellcode/annoy_user.exe4.The
-
http://www.practicalmalwareanalysis.com/shellcode/annoy_user.exe.The
-
http://www.practicalmalwareanalysis.com/cpp.html
-
http://www.practicalmalwareanalysis.com/cpp.html.
-
http://ftp.practicalmalwareanalysis.com
-
http://467cfile.read
-
http://69.data
-
http://eff.org/nsaEFF
-
http://eff.org/freespeechEFF's
-
http://eff.org/patentEFF
-
http://eff.org/IP/fairuseEFF
-
http://eff.org/transparencyEFF
-
http://eff.org/globalPRIVACYFREE
-
http://www.eff.org/support
-
http://nostarch.com/malware.htm
- Show all
-