Resubmissions

14/03/2024, 17:51

240314-wfggfacg48 6

14/03/2024, 17:42

240314-wahsbaad8z 6

General

  • Target

    DocCloud.zip.zip

  • Size

    6.7MB

  • MD5

    ee66c2eb5667a14d9188c1848c3cd415

  • SHA1

    256f6110cb2a65c9a56ff6cc27c0077932f5e3ba

  • SHA256

    def9f30212724d624c731b2249db07ca59e3dcb236366f0850ce498b7fc4cd90

  • SHA512

    1d651b99385db166123cd6c89b42a7f33c08844bf3fe997e06e2bec628a8f51a4e778dadc737193a6d3baaabeb827ed0e5f3216b39dd312fd9bfb8864c64c1c3

  • SSDEEP

    196608:vUVhhDmLQF6b9GMJporjbZpxOMk9Ur2cCWbBW:vUV+xMjVp7gi2cCWbBW

Score
6/10

Malware Config

Signatures

  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

Files

  • DocCloud.zip.zip
    .zip

    Password: infected

  • DocCloud.zip
    .zip
  • Esl/Aiod.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    1617abc63b58a25baa901c2b1d07d8c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PDFPrevHndlr.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    Password: infected

    fa32d17e65a7b88daa998c4cd864aa48


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PDFSigQFormalRep.pdf
    .pdf

    Password: infected

  • RTC.der
  • Resource/CMap/Identity-H
  • Resource/CMap/Identity-V
  • Resource/CMap/UCS2-GBK-EUC
  • Resource/CMap/UniKS-UTF16-H
  • Resource/CMap/UniKS-UTF16-V
  • Resource/Font/AdobePIStd.otf
  • Resource/Font/CourierStd-Bold.otf
  • Resource/Font/CourierStd-BoldOblique.otf
  • Resource/Font/CourierStd-Oblique.otf
  • Resource/Font/CourierStd.otf
  • Resource/Font/MinionPro-Bold.otf
  • Resource/Font/MinionPro-BoldIt.otf
  • Resource/Font/MinionPro-It.otf
  • Resource/Font/MinionPro-Regular.otf
  • Resource/Font/MyriadPro-Bold.otf
  • Resource/Font/MyriadPro-BoldIt.otf
  • Resource/Font/MyriadPro-It.otf
  • Resource/Font/MyriadPro-Regular.otf
  • Resource/Font/Pfm/SY______.PFM
  • Resource/Font/Pfm/zx______.pfm
  • Resource/Font/Pfm/zy______.pfm
  • Resource/Font/SY______.PFB
  • Resource/Font/ZX______.PFB
  • Resource/Font/ZY______.PFB
  • Resource/SaslPrep/SaslPrepProfile_norm_bidi.spp
  • Resource/TypeSupport/Unicode/ICU/icudt26l.dat
  • Resource/TypeSupport/Unicode/Mappings/Adobe/symbol.txt
  • Resource/TypeSupport/Unicode/Mappings/Adobe/zdingbat.txt
  • Resource/TypeSupport/Unicode/Mappings/Mac/CENTEURO.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/CORPCHAR.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/CROATIAN.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/CYRILLIC.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/GREEK.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/ICELAND.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/ROMAN.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/ROMANIAN.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/SYMBOL.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/TURKISH.TXT
  • Resource/TypeSupport/Unicode/Mappings/Mac/UKRAINE.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1250.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1251.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1252.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1253.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1254.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1257.TXT
  • Resource/TypeSupport/Unicode/Mappings/win/CP1258.TXT
  • ScCore.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    4a57a768f07e6debe1e3b1c4553488bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pe.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    ac0859548f5c53e0e3579baeff9163c3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pmd.cer
  • rt3d.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    3dc7ed1ee61c38efac74635d0ea2c252


    Code Sign

    Headers

    Imports

    Exports

    Sections