Behavioral task
behavioral1
Sample
analisis.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
analisis.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
analisis.pdf
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
informe_payload.exe
Resource
win7-20240508-en
Behavioral task
behavioral5
Sample
informe_payload.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
informe_payload.exe
Resource
win11-20240419-en
General
-
Target
analisis.pdf
-
Size
212KB
-
MD5
f28baa94ff32d8a4b006004b3c9c4261
-
SHA1
54677341b7e233d8c0b6dcd38dc5e9d1a58511ef
-
SHA256
cc48d8c645c27dd850652c0a66e22dd2e1b62bbf6ad208f94b8f5847684a8d17
-
SHA512
853dc19d16e4387210e63b3de74c044db802e429bf12d082e00b66f127bb64e742cad32e2b1f23661a11cb47341d7b34e249533b2fb15a3815ed81b677f64989
-
SSDEEP
3072:cyu1+HubW8lW1Sn6WEQKLy0jSaMWyAKCxxDghhiR9j4BIIADNI63Cv3UOLn5ZVv1:cyu1PdWEHEQlWyA/7am9kBAJIECvv5bd
Malware Config
Signatures
-
PDF contains JavaScript
Detects presence of JavaScript in PDF files.
-
PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/informe_payload.pdf
Files
-
analisis.pdf.pdf
-
http://maldev.pcte.co
-
-
informe_payload.pdf.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 893B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ