Behavioral task
behavioral1
Sample
bf293d5b35bc968e0d8bffba2b217c47d9a32cf33f83a579c87eb06c450ffe8d.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bf293d5b35bc968e0d8bffba2b217c47d9a32cf33f83a579c87eb06c450ffe8d.pdf
Resource
win10v2004-20240226-en
General
-
Target
bf293d5b35bc968e0d8bffba2b217c47d9a32cf33f83a579c87eb06c450ffe8d
-
Size
24.1MB
-
MD5
f7807b001b74fe005f8d04587c472412
-
SHA1
c19e967b507ca6f19ea844510252b65e09950cec
-
SHA256
bf293d5b35bc968e0d8bffba2b217c47d9a32cf33f83a579c87eb06c450ffe8d
-
SHA512
96ddee4b2363861e28d598a770d2af9ac769191d2cedd88784dcd0ffa43aa7cc007058adb7212b204057eee8737cc2b693da7a049e9ff858f3e664472c5c3533
-
SSDEEP
393216:RC7nCIi4OLmnRgaGqelMnBQYseJpLrVF4TfuSbmwx43/FWX:R2CD37lMBhBF4TuwxUIX
Malware Config
Signatures
Files
-
bf293d5b35bc968e0d8bffba2b217c47d9a32cf33f83a579c87eb06c450ffe8d.pdf
-
https://doi.org/10.1007/978-1-4842-8634-0
-
https://doi.org/10.1007/978-1-4842-8634-0_1
-
https://doi.org/10.1007/978-1-4842-8634-0_2
-
https://doi.org/10.1007/978-1-4842-8634-0_3
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15#server-level-audit-action-groups
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15#database-level-audit-actions
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15#database-level-audit-action-groups
-
https://doi.org/10.1007/978-1-4842-8634-0_4
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/write-sql-server-audit-events-to-the-security-log?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-records?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/diagnostic-connection-for-database-administrators?view=sql-server-ver15#connecting-with-dac
-
https://doi.org/10.1007/978-1-4842-8634-0_5
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-server-file-audits-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-server-audit-specification-details-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-server-audit-specifications-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-audit-specification-details-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-audit-specifications-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-audit-actions-transact-sql?view=sql-server-ver15
-
https://doi.org/10.1007/978-1-4842-8634-0_6
-
https://docs.microsoft.com/en-us/sql/relational-databases/extended-events/sql-server-extended-events-packages?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/extended-events/targets-for-extended-events-in-sql-server?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/t-sql/statements/create-event-session-transact-sql?view=sql-server-ver15#with--event_session_options--n-
-
https://doi.org/10.1007/978-1-4842-8634-0_7
-
https://doi.org/10.1007/978-1-4842-8634-0_8
-
https://docs.microsoft.com/en-us/sql/relational-databases/extended-events/xevents-references-system-objects?view=sql-server-ver15#system-catalog-views
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-xe-file-target-read-file-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-event-session-transact-sql?view=sql-server-ver15
-
https://doi.org/10.1007/978-1-4842-8634-0_9
-
https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/server-configuration-options-sql-server?view=sql-server-ver15#configuration-options-table
-
https://doi.org/10.1007/978-1-4842-8634-0_10
-
https://docs.microsoft.com/en-us/sql/relational-databases/track-changes/work-with-change-tracking-sql-server?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/track-changes/track-data-changes-sql-server?view=sql-server-ver15#feature-differences-between-change-data-capture-and-change-tracking
-
https://docs.microsoft.com/en-us/sql/relational-databases/track-changes/enable-and-disable-change-data-capture-sql-server?view=sql-server-ver15#enable-for-a-table
-
https://docs.microsoft.com/en-us/sql/relational-databases/track-changes/administer-and-monitor-change-data-capture-sql-server?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-tables/change-data-capture-tables-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/cdc-fn-cdc-get-all-changes-capture-instance-transact-sql?view=sql-server-ver15
-
https://docs.microsoft.com/en-us/sql/relational-databases/tables/modifying-data-in-a-system-versioned-temporal-table?view=sql-server-ver16
-
https://docs.microsoft.com/en-us/sql/relational-databases/tables/getting-started-with-system-versioned-temporal-tables?view=sql-server-ver16
-
https://docs.microsoft.com/en-us/sql/relational-databases/triggers/ddl-triggers?view=sql-server-ver15
-
https://doi.org/10.1007/978-1-4842-8634-0_11
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode?view=sql-server-ver16
-
https://docs.microsoft.com/en-us/sql/relational-databases/database-mail/configure-database-mail?view=sql-server-ver15
-
https://doi.org/10.1007/978-1-4842-8634-0_12
-
https://docs.microsoft.com/en-us/sql/powershell/run-windows-powershell-steps-in-sql-server-agent?view=sql-server-ver15#PShellJob
-
https://doi.org/10.1007/978-1-4842-8634-0_13
-
https://portal.azure.com
-
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/quick-create-workspace
-
https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql#audit-storage-destination
-
https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql#audit-event-hub-destination
-
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/
-
https://docs.microsoft.com/en-us/azure/cloud-shell/quickstart-powershell
-
https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal
-
https://docs.microsoft.com/en-us/azure/logic-apps/quickstart-create-first-logic-app-workflow
-
https://doi.org/10.1007/978-1-4842-8634-0_14
-
https://doi.org/10.1007/978-1-4842-8634-0_15
-
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Options.Audit.html#Appendix.SQLServer.Options.Audit.S3bucket
-
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html
-
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Options.Audit.html
-
https://aws.amazon.com/blogs/database/set-up-extended-events-in-amazon-rds-for-sql-server/
-
https://cloud.google.com/sql/docs/features#sqlserver
-
https://doi.org/10.1007/978-1-4842-8634-0_16
-
https://doi.org/10.1007/978-1-4842-8634-0en-USCopyright
-
http://www.springeronline.com
-
http://springernature.com
-
http://www.apress.com/bulk-sales.en-USAny
-
https://github.com/Apress
-
http://www.en-USapress.com/source-code.en-USPrinted
-
http://gmail.com
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsecurity/auditing/sql-server-audit-action-groups-and-en-USactions?view=sql-server-ver15#server-level-audit-en-USaction-groupsen-GB���
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsecurity/auditing/sql-server-audit-action-groups-and-en-USactions?view=sql-server-ver15#database-level-audit-en-USaction-groupsen-USWhen
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsecurity/auditing/sql-server-audit-action-groups-and-en-USactions?view=sql-server-ver15#database-level-audit-actionsen-US���
-
https://en-USdocs.microsoft.com/en-us/sql/relational-databases/security/auditing/write-en-USsql-server-audit-events-to-the-security-log?view=sql-server-ver15en-USIf
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsecurity/auditing/sql-server-audit-records?view=sql-en-USserver-ver15en-UShttps://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-functions/sys-fn-get-audit-file-transact-sql?view=sql-en-USserver-ver15en-GB���
-
https://docs.microsoft.com/en-us/sql/database-en-USengine/configure-windows/diagnostic-connection-for-database-en-USadministrators?view=sql-server-ver15#connecting-with-dacen-USYou
-
http://script.fr
-
http://5-1.fr
-
http://en-US5-2en-US.fr
-
http://5-2.fr
-
http://en-US5-3en-US.fr
-
http://5-3.fr
-
http://en-US5-4en-US.fr
-
http://5-4.fr
-
https://docs.microsoft.com/en-us/sql/relational-databases/security/en-USauditing/write-sql-server-audit-events-to-the-security-log?view=sql-en-USserver-ver15en-USIf
-
http://5-5.fr
-
http://5-6.fr
-
http://5-7.fr
-
http://settings.fr
-
http://5-8.fr
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-catalog-views/sys-server-file-audits-transact-en-USsql?view=sql-server-ver15en-USListing
-
http://5-9.fr
-
http://sas.name
-
http://sfa.name
-
http://sas.is
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-catalog-views/sys-server-audit-specifications-en-UStransact-sql?view=sql-server-ver15en-UShttps://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-catalog-views/sys-server-audit-specification-details-en-UStransact-sql?view=sql-server-ver15en-USListing
-
http://5-10.fr
-
http://das.name
-
http://das.is
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-catalog-views/sys-database-audit-specifications-en-UStransact-sql?view=sql-server-ver15en-UShttps://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-catalog-views/sys-database-audit-specification-en-USdetails-transact-sql?view=sql-server-ver15en-GB���
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsecurity/auditing/sql-server-audit-records?view=sql-en-USserver-ver15en-UShttps://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-functions/sys-fn-get-audit-file-transact-sql?view=sql-en-USserver-ver15CHAPTER
-
http://hours.fr
-
http://5-11.fr
-
http://aa.name
-
http://sys.dm
-
https://docs.en-USmicrosoft.com/en-us/sql/relational-databases/system-en-USfunctions/sys-fn-get-audit-file-transact-sql?view=sql-en-USserver-ver15en-USFind
-
https://docs.en-USmicrosoft.com/en-us/sql/relational-databases/system-dynamic-en-USmanagement-views/sys-dm-audit-actions-transact-sql?view=sql-en-USserver-ver15en-USThere
-
http://audit.fr
-
http://5-12.fr
-
http://5-13.fr
-
http://en-US5-14en-US.fr
-
http://5-14.fr
-
http://scripts.fr
-
http://5-15.fr
-
http://en-US5-16en-US.fr
-
http://5-16.fr
-
http://5-17.fr
-
http://done.fr
-
http://5-18.fr
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USextended-events/sql-server-extended-events-packages?view=sql-en-USserver-ver15en-USThere
-
https://docs.en-USmicrosoft.com/en-us/sql/relational-databases/extended-en-USevents/targets-for-extended-events-in-sql-server?view=sql-en-USserver-ver15CH���aAP���t�e�rTER
-
https://en-USdocs.microsoft.com/en-us/sql/t-sql/statements/create-event-en-USsession-transact-sql?view=sql-server-ver15#with--event_en-USsession_options--n-en-USAgain,
-
http://stopped.fr
-
http://box.fr
-
http://event.fr
-
http://events.fr
-
http://8-1.fr
-
http://queries.fr
-
http://8-2.fr
-
http://142en-USsys.dm
-
http://eventsen-USsys.dm
-
http://change.fr
-
http://8-3.fr
-
http://en-US8-6en-US.fr
-
http://8-4.fr
-
http://es.name
-
http://se.name
-
http://sa.name
-
http://8-5.fr
-
http://st.name
-
http://size.fr
-
http://8-6.fr
-
http://sf.name
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USextended-events/xevents-references-system-objects?view=sql-en-USserver-ver15#system-catalog-viewsen-US���
-
http://en-US8-7en-US.fr
-
http://8-7.fr
-
https://docs.microsoft.com/en-us/sql/relational-databases/en-USsystem-functions/sys-fn-xe-file-target-read-file-transact-en-USsql?view=sql-server-ver15en-USThere
-
http://8-8.fr
-
https://docs.en-USmicrosoft.com/en-us/sql/t-sql/statements/alter-event-session-en-UStransact-sql?view=sql-server-ver15CHAPTER
-
http://data.fr
-
http://8-9.fr
-
http://en-US8-10en-US.fr
-
http://8-10.fr
-
http://en-US8-11en-US.fr
-
http://8-11.fr
-
http://means.fr
-
http://9-1.fr
-
http://9-2.fr
-
http://en-US9-3en-US.fr
-
http://9-3.fr
-
http://en-US10-1en-US.fr
-
http://10-1.fr
-
http://use.fr
-
http://10-2.fr
-
http://en-US10-3en-US.fr
-
http://10-3.fr
-
https://docs.en-USmicrosoft.com/en-����
-
https://docs.microsoft.com/en-����
-
http://en-US10-4en-US.fr
-
http://10-4.fr
-
http://on.fr
-
http://10-5.fr
-
http://en-US10-6en-US.fr
-
http://10-6.fr
-
http://en-US10-7en-US.fr
-
http://10-7.fr
-
http://en-US10-8en-US.fr
-
http://10-8.fr
-
https://en-USdocs.microsoft.com/en-����
-
http://en-US10-9en-US.fr
-
http://10-9.fr
-
http://you.fr
-
http://10-10.fr
-
http://en-US10-11en-US.fr
-
http://10-11.fr
-
http://en-US10-12en-US.fr
-
http://10-12.fr
-
http://en-US10-13en-US.fr
-
http://10-13.fr
-
http://en-US10-14en-US.fr
-
http://10-14.fr
-
http://10-15.fr
-
https://docs.microsoft.com/en-US
-
http://en-US11-1en-US.fr
-
http://11-1.fr
-
http://server.fr
-
http://11-2.fr
-
http://_servername.fr
-
http://11-3.fr
-
http://en-US11-4en-US.fr
-
http://11-4.fr
-
http://en-US11-5en-US.fr
-
http://11-5.fr
-
http://database.fr
-
http://11-6.fr
-
http://this.fr
-
http://11-7.fr
-
http://later.fr
-
http://11-8.fr
-
http://job.fr
-
http://11-9.fr
-
https://docs.en-USmicrosoft.com/en-us/sql/relational-databases/database-mail/en-USconfigure-database-mail?view=sql-server-ver15en-USYou
-
http://en-US12-1en-US.fr
-
http://12-1.fr
-
http://12-2.fr
-
http://it.fr
-
http://12-3.fr
-
http://domain.com
-
http://smtp.domain.com
-
http://p.name
-
http://a.name
-
http://en-US12-4en-US.fr
-
http://12-4.fr
-
http://days.fr
-
http://12-5.fr
-
https://docs.microsoft.com/en-us/sql/powershell/run-windows-en-USpowershell-steps-in-sql-server-agent?view=sql-server-en-USver15#PShellJoben-USIn
-
https://en-USdocs.microsoft.com/en-us/azure/azure-sql/database/auditing-en-USoverview?view=azuresql#audit-storage-destinationen-US����
-
https://docs.microsoft.com/en-us/azure/en-USazure-sql/database/auditing-overview?view=azuresql#audit-en-USevent-hub-destinationen-USMy
-
https://docs.en-USmicrosoft.com/en-us/azure/azure-monitor/logs/quick-create-en-USworkspaceen-USIt�s
-
http://13-1.fr
-
http://en-US13-2en-US.fr
-
http://13-2.fr
-
https://en-USdocs.microsoft.com/en-us/azure/cloud-shell/quickstart-en-USpowershellen-USYou
-
http://en-US13-3en-US.fr
-
http://13-3.fr
-
https://en-USdocs.microsoft.com/en-us/sql/relational-databases/security/en-USauditing/sql-server-audit-action-groups-and-actions?view=en-US
-
http://13-4.fr
-
https://docs.microsoft.com/en-us/azure/en-USstorage/blobs/lifecycle-management-policy-configure?tabs=en-US
-
http://13-5.fr
-
http://credential.fr
-
http://13-6.fr
-
http://en-US13-7en-US.fr
-
http://13-7.fr
-
http://en-US13-23en-US.fr
-
http://13-8.fr
-
https://azuresqldbaudits.en-USblob.core.windows.net/xelfiles/xelauditdata.xel',max_file_size=
-
http://en-US13-9en-US.fr
-
http://13-9.fr
-
https://azuresqldbaudits.blob.core.en-USwindows.net/xelfiles/
-
http://en-US14-1en-US.fr
-
http://14-1.fr
-
http://en-US14-2en-US.fr
-
http://14-2.fr
-
http://14-3.fr
-
https://docs.microsoft.com/en-en-USus/azure/data-explorer/kusto/query/en-USThe
-
http://14-4.fr
-
http://en-US14-5en-US.fr
-
http://14-5.fr
-
http://en-US14-6en-US.fr
-
http://14-6.fr
-
http://en-US14-7en-US.fr
-
http://14-7.fr
-
http://en-US14-8en-US.fr
-
http://14-8.fr
-
https://azuremiauditing.blob.en-UScore.windows.net/miauditfiles/xelauditdata.xel',max_file_size=
-
http://en-US14-9en-US.fr
-
http://14-9.fr
-
https://azuremiauditing.blob.core.en-USwindows.net/miauditfiles/xelauditdata_0_132972103478750000.xel',
-
https://docs.en-USaws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.en-USOptions.Audit.html#Appendix.SQLServer.Options.Audit.S3bucketen-USThis
-
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-en-USlifecycle-mgmt.htmlen-GB���
-
http://en-US15-1en-US.fr
-
http://15-1.fr
-
http://en-US15-2en-US.fr
-
http://15-2.fr
-
http://en-US15-3en-US.fr
-
http://15-3.fr
-
http://15-4.fr
-
http://path.fr
-
http://15-5.fr
-
https://docs.en-USaws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.en-USOptions.Audit.htmlen-USNicely,
-
http://15-6.fr
-
http://en-US15-7en-US.fr
-
http://15-7.fr
-
https://aws.en-USamazon.com/blogs/database/set-up-extended-events-in-amazon-en-USrds-for-sql-server/en-US���
- Show all
-