Behavioral task
behavioral1
Sample
10216e91ea44838a510687e15b1a108adc2bc22ec3de2a66dc5525468ab401b0.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10216e91ea44838a510687e15b1a108adc2bc22ec3de2a66dc5525468ab401b0.pdf
Resource
win10v2004-20240226-en
General
-
Target
10216e91ea44838a510687e15b1a108adc2bc22ec3de2a66dc5525468ab401b0
-
Size
17.4MB
-
MD5
1a4804388a115ff02ed8b5a2ab0e4a99
-
SHA1
57124f2ca910257f6b98d82a8724c0c6aa088f31
-
SHA256
10216e91ea44838a510687e15b1a108adc2bc22ec3de2a66dc5525468ab401b0
-
SHA512
a9311e22b1562ac9c6c21c8c0b356f5a59df25b4788263638fe41707ec05b5b3195fc827c88b2316f0142b969c3471ff95b8e8b497630cc722e586d88feb7454
-
SSDEEP
393216:rXpv84VlH7xEe+AElPMAnYoF5mWFWjSKhb0W/y1Hzu5stI:RjHdr+R0q3mWFHu0WQHz2stI
Malware Config
Signatures
Files
-
10216e91ea44838a510687e15b1a108adc2bc22ec3de2a66dc5525468ab401b0.pdf
-
http://www.packtpub.com
-
https://mapt.io/
-
http://www.PacktPub.com
-
http://authors.packtpub.com
-
https://github.com/automatedlab/automatedlab
-
http://www.packtpub.com/support
-
https://github.com/PacktPublishing/Learn-PowerShell-Core-6.0
-
https://github.com/PacktPublishing/
-
https://www.packtpub.com/sites/default/files/downloads/LearnPowerShellCore6_ColorImages.pdf
-
http://www.packtpub.com/submit-errata
-
http://authors.packtpub.com/
-
https://www.packtpub.com/
-
https://github.com/PowerShell/PowerShell/releases
-
https://windowsserver.uservoice.com/forums/301869-powershell
-
https://azure.microsoft.com/en-us/blog/powershell-is-open-sourced-and-is-available-on-linux/
-
https://github.com/PowerShell/PowerShell
-
https://docs.microsoft.com/en-us/powershell/
-
https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md
-
https://github.com/PowerShell/PowerShell-RFC/tree/master/CommunityCall
-
https://github.com/dotnet/standard
-
https://aka.ms/cloudshell/PowerShell-Docs
-
https://feedback.azure.com/forums/598699-azure-cloud-shell
-
https://docs.microsoft.com/en-us/powershell/wmf/5.1/install-configure
-
https://azure.microsoft.com/en-us/features/cloud-shell/
-
https://poshgui.com/
-
https://docs.microsoft.com/en-us/powershell/scripting/core-powershell/ise/introducing-the-windows-powershell-ise
-
https://code.visualstudio.com/download
-
https://code.visualstudio.com/docs/
-
https://github.com/Microsoft/vscode-tips-and-tricks
-
https://docs.microsoft.com/en-us/powershell/scripting/powershell-scripting
-
https://git-scm.com/
-
http://aka.ms/vscodekeybindings
-
https://github.com/ddneves/Book_Learn_PowerShell
-
https://github.com/PoshCode/PowerShellPracticeAndStyle
-
https://msdn.microsoft.com/en-us/library/ms714395(v=vs.85).aspx
-
https://msdn.microsoft.com/en-us/library/ms714428(v=vs.85).aspx
-
https://kevinmarquette.github.io/2018-01-12-Powershell-switch-statement/
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_break
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_continue
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_operators
-
https://kevinmarquette.github.io/2017-04-10-Powershell-exceptions-everything-you-ever-wanted-to-know/
-
https://docs.microsoft.com/en-us/dotnet/standard/security/how-to-use-data-protection
-
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.processstartinfo?view=netframework-4.7.1
-
https://docs.microsoft.com/en-us/dotnet/csharp/programming-guide/concepts/linq/
-
https://docs.microsoft.com/en-us/dotnet/standard/parallel-programming
-
http://petstore.swagger.io/
-
https://msdn.microsoft.com/en-us/library/aa394606(v=vs.85).aspx
-
https://github.com/dlwyatt/ProtectedData
-
https://docs.microsoft.com/en-us/dotnet/api
-
https://github.com/nightroman/SplitPipeline
-
https://github.com/powershell/polaris
-
https://docs.microsoft.com/en-us/powershell/module/cimcmdlets/?view=powershell-6
-
https://www.dmtf.org/
-
https://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm
-
https://en.wikipedia.org/wiki/Cyclomatic_complexity
-
https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell-core-on-linux
-
https://blogs.msdn.microsoft.com/powershell/2008/09/30/powershells-security-guiding-principles/
-
https://sourcemaking.com/antipatterns/the-blob
-
https://github.com/PowershellFrameworkCollective/PSModuleDevelopment
-
https://www.atlassian.com/git/tutorials/what-is-version-control
-
https://git-scm.com/docs/gitignore
-
https://git-scm.com/docs/git-checkout#_detached_head
-
https://github.com/PowerShell/PSScriptAnalyzer/blob/development/ScriptRuleDocumentation.md
-
https://github.com/PowerShell/PSScriptAnalyzer
-
https://github.com
-
https://gitlab.com
-
https://bitbucket.org
-
https://visualstudio.com
-
https://git-scm.com
-
https://github.com/powershell/platyps
-
https://support.microsoft.com/en-us/help/253597/automating-disk-cleanup-tool-in-windows
-
https://msdn.microsoft.com/en-us/library/bb776782(v=vs.85).aspx
-
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy
-
https://github.com/dfinke/ImportExcel
-
https://msdn.microsoft.com/en-us/library/ms256471
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_types.ps1xml
-
https://www.json.org/
-
https://code.visualstudio.com/docs/getstarted/settings
-
https://code.visualstudio.com/docs/getstarted/tips-and-tricks
-
https://docs.microsoft.com/en-us/dotnet/csharp/programming-guide/classes-and-structs/polymorphism
-
https://github.com/ddneves/LogFileParser
-
https://blogs.msdn.microsoft.com/daviddasneves/2017/10/27/logfileparser-with-powershell/
-
https://docs.microsoft.com/en-us/powershell/scripting/getting-started/cookbooks/working-with-registry-entries
-
http://www.powertheshell.com/download/registry_cookbook.pdf
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/join-path
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/import-csv
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertto-json
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertfrom-json
-
https://docs.microsoft.com/en-us/powershell/scripting/getting-started/cookbooks/using-static-classes-and-methods
-
https://www.accenture.com/us-en/insight-cost-of-cybercrime-2017
-
https://blogs.technet.microsoft.com/johnla/2015/04/26/defenders-think-in-lists-attackers-think-in-graphs-as-long-as-this-is-true-attackers-win/
-
https://www.youtube.com/watch?v=Ig2bbfSzBCM
-
https://github.com/BloodHoundAD/BloodHound
-
https://social.technet.microsoft.com/wiki/contents/articles/37509.what-is-active-directory-red-forest-design.aspx
-
https://blogs.msdn.microsoft.com/powershell/2017/04/10/a-comparison-of-shell-and-scripting-language-security/
-
http://www.exploit-monday.com/2017/01/powershell-is-not-special-offensive.html
-
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
-
https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide
-
https://docs.microsoft.com/en-us/dotnet/standard/security/secure-coding-guidelines
-
https://blogs.technet.microsoft.com/ashleymcglone/2016/06/29/whos-afraid-of-powershell-security/
-
https://docs.microsoft.com/en-us/powershell/scripting/setup/ps-remoting-second-hop
-
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material
-
https://docs.microsoft.com/en-us/dotnet/api/system.management.automation
-
https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe
-
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
-
https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
-
https://blogs.msdn.microsoft.com/powershell/2017/11/02/powershell-constrained-language-mode/
-
http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
-
https://blogs.msdn.microsoft.com/aaron_margosis/2018/06/26/announcing-application-whitelisting-with-aaronlocker/
-
http://www.exploit-monday.com/2018/06/device-guard-and-application.html
-
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
-
https://posts.specterops.io/threat-detection-using-windows-defender-application-control-device-guard-in-audit-mode-602b48cd1c11
-
https://github.com/danielbohannon/Invoke-Obfuscation
-
https://github.com/danielbohannon/Invoke-CradleCrafter
-
https://docs.microsoft.com/en-us/powershell/wmf/5.0/audit_script
-
https://blogs.technet.microsoft.com/jepayne/2017/12/08/weffles/
-
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction
-
https://blogs.msdn.microsoft.com/daviddasneves/2018/04/25/prioritize-all-the-security-controls/
-
https://docs.microsoft.com/en-us/powershell/scripting/setup/winrmsecurity
-
https://docs.microsoft.com/en-us/powershell/scripting/core-powershell/wsman-remoting-in-powershell-core
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy
-
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
-
https://blogs.msdn.microsoft.com/daviddasneves/2017/05/25/powershell-security-at-enterprise-customers/
-
https://blogs.msdn.microsoft.com/powershell/2015/06/09/powershell-the-blue-team/
-
https://github.com/SwiftOnSecurity/sysmon-config
-
https://www.microsoft.com/en-us/cloud-platform/advanced-threat-analytics
-
https://www.microsoft.com/en-us/windowsforbusiness/windows-atp
-
https://msdn.microsoft.com/powershell/jea/overview
-
https://github.com/PowerShell/JEA
-
http://www.devsecops.org/blog/2015/2/15/what-is-devsecops
-
https://github.com/matthitchcock/trust-the-rp/blob/master/trust-the-release-pipeline.md
-
https://www.nuget.org/
-
https://en.wikipedia.org/wiki/Test-driven_development
-
https://github.com/powershell/operation-validation-framework
-
https://dbatools.io
-
https://docs.microsoft.com/en-us/azure/devops
-
https://devops.com
-
https://www.winops.org/
-
https://github.com/NuGet/NuGetGallery
-
https://inedo.com/proget
-
https://jfrog.com/artifactory/
-
http://nugetserver.net
-
https://github.com/svenkle/nuget-server
-
https://www.sonatype.com/nexus-repository-sonatype
-
https://www.jetbrains.com/teamcity
-
https://msdn.microsoft.com/en-us/library/hh852735(v=vs.85).aspx
-
https://chocolatey.org/
-
https://jfrog.com/artifactory
-
https://github.com/PowerShell/platyps
-
https://github.com/settings/tokens/new
-
https://github.com/PowerShell/Plaster/blob/master/docs/en-US/about_Plaster_CreatingAManifest.help.md
-
https://github.com/PowerShell/Plaster/issues/224
-
https://insights.stackoverflow.com/survey/2018
-
https://www.appveyor.com/docs/appveyor-yml
-
https://github.com/pester
-
https://github.com/powershell/plaster
-
https://github.com/powershell/psscriptanalyzer
-
https://github.com/RamblingCookieMonster/PSDeploy
-
https://github.com/RamblingCookieMonster/BuildHelpers
-
https://ci.appveyor.com
-
http://ramblingcookiemonster.github.io/Building-A-PowerShell-Module
-
https://github.com/AutomatedLab/AutomatedLab.Common
-
https://github.com/Microsoft/PowerShell-DSC-for-Linux
-
https://blogs.msdn.microsoft.com/powershell/2017/09/12/dsc-future-direction-update/
-
https://github.com/powershell/dscresources
-
https://docs.microsoft.com/en-us/sysinternals/learn/windows-internals
-
https://blogs.msdn.microsoft.com/powershell/2012/08/24/introduction-to-cim-cmdlets/
-
https://blogs.technet.microsoft.com/mniehaus/2017/10/10/improved-windows-update-log-formatting-with-windows-10-1709/
-
https://msdn.microsoft.com/en-us/library/windows/desktop/aa373208(v=vs.85).aspx
-
https://blogs.technet.microsoft.com/mniehaus/2016/08/23/windows-10-1607-keeping-apps-from-coming-back-when-deploying-the-feature-update/
-
https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10
-
https://blogs.technet.microsoft.com/ashleymcglone/2013/08/28/powershell-get-winevent-xml-madness-getting-details-from-event-logs/
-
https://docs.microsoft.com/en-us/powershell/module/appx/get-appxpackage?view=win10-ps
-
https://docs.microsoft.com/en-us/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps
-
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options
-
http://maikkoster.com/cim-vs-wmi-cmdlets-the-top-reasons-i-changed/
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog
-
https://docs.microsoft.com/en-us/powershell/module/cimcmdlets/
-
https://msdn.microsoft.com/en-us/library/windows/desktop/aa385780(v=vs.85).aspx
-
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent
-
https://blogs.msdn.microsoft.com/luisdem/2016/02/09/browsing-in-internet-explorer-via-powershell/
-
http://portal.azure.com
-
https://github.com/powershell/ships
-
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-templates-resources
-
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-functions
-
https://portal.azure.com
-
https://docs.microsoft.com/en-us/azure/azure-resource-manager
-
https://products.office.com/en/business/compare-more-office-365-for-business-plans
-
https://www.microsoft.com/de-de/download/details.aspx?id=41950
-
https://docs.microsoft.com/en-us/powershell/module/msonline/?view=azureadps-1.0
-
https://docs.microsoft.com/de-de/powershell/module/Azuread/?view=azureadps-2.0
-
https://products.office.com/en/exchange/compare-microsoft-exchange-online-plans
-
https://outlook.office365.com/ecp/
-
https://partner.outlook.cn/PowerShell
-
https://outlook.office.de/powershell-liveid/
-
https://outlook.office365.com/powershell-liveid/
-
http://technet.microsoft.com/library/ace44f6b-4084-4f9c-89b3-e0317962472b.aspx
-
https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell
-
https://products.office.com/en-us/sharepoint/compare-sharepoint-plans
-
https://www.microsoft.com/en-us/download/details.aspx?id=35588
-
https://docs.microsoft.com/en-us/powershell/module/sharepoint-online/?view=sharepoint-ps
-
https://docs.microsoft.com/en-us/microsoftteams/office-365-licensing
-
https://github.com/MicrosoftDocs/office-docs-powershell/tree/master/teams/teams-ps/teams
-
https://docs.microsoft.com/en-us/powershell/module/teams/?view=teams-ps
-
https://docs.microsoft.com/en-us/office365/enterprise/powershell/connect-to-office-365-powershell
-
https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell
-
https://docs.microsoft.com/en-us/powershell/sharepoint/sharepoint-online/connect-sharepoint-online
-
https://support.office.com/en-us/article/how-do-i-get-access-to-microsoft-teams-fc7f1634-abd3-4f26-a597-9df16e4ca65b
-
https://docs.microsoft.com/en-us/powershell/module/configurationmanager/?view=sccm-ps
-
https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-deploy-scripts
-
https://github.com/NickolajA/PowerShell/tree/master/ConfigMgr
-
https://blogs.msdn.microsoft.com/daviddasneves/2017/10/15/some-tools-of-a-pfe/
-
http://psappdeploytoolkit.com/
-
https://github.com/Microsoft/ReportingServicesTools
-
https://dbachecks.io
-
https://github.com/pester/Pester
-
https://psframework.org
-
https://powerintheshell.com/category/psgui/
-
https://github.com/gaelcolas/Datum
-
https://gaelcolas.com/2018/02/07/composing-dsc-roles
-
https://www.red-gate.com/simple-talk/dotnet/net-framework/high-performance-powershell-linq/
-
https://github.com/KevinMarquette/ConvertTo-Breakpoint
-
https://www.meetup.com/
-
https://blogs.msdn.microsoft.com/powershell/
-
https://mva.microsoft.com/search/SearchResults.aspx?q=PowerShell
-
https://channel9.msdn.com/Tags/powershell
-
https://blogs.technet.microsoft.com/heyscriptingguy/
-
https://social.technet.microsoft.com/wiki/contents/articles/183.windows-powershell-survival-guide.aspx
-
https://blog.feedspot.com/powershell_blogs/
-
https://blogs.msdn.microsoft.com/daviddasneves/2017/08/06/how-to-become-a-powershell-pro-v2/
-
https://docs.microsoft.com/en-us/powershell/scripting/core-powershell/ise/keyboard-shortcuts-for-the-windows-powershell-ise?view=powershell-5.1
-
http://aka.ms/vscodekeybindings/
-
https://code.visualstudio.com/docs/getstarted/keybindings#_keyboard-layouts
-
https://code.visualstudio.com/docs/getstarted/keybindings
-
https://www.packtpub.com/networking-and-servers/windows-server-2016-automation-powershell-cookbook-second-edition
-
https://www.packtpub.com/networking-and-servers/mastering-windows-powershell-scripting-second-edition
- Show all
-