125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/11.bat
Size 372B
Sample240605-m6ek4aee74
SHA256 181d381adb3432f7040293cd2bb5cefee1e4c2843a2b0205e7f94a2027d2cc3e
MD5 6474bbdafe540076664f59e23be96ad7
SHA1 2bf5ae382c5a9436173a92db3706c1b2982d05f7
SHA512 aaf378915d0cd137d26cb2f351e604a4805fee112918b4fe6f8bf5f48dd16e698494ff651315ebcebd3f4ae7fc1524d943423a053c93c9cabe050c731a5e8c84
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/3040-1-0x0000000000640000-0x000000000070E000-memory.dmp	upx
behavioral5/memory/3040-8-0x0000000000640000-0x000000000070E000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3040	pdfstamp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3040	2876	cmd.exe	29
PID 2876 wrote to memory of 3040	2876	cmd.exe	29
PID 2876 wrote to memory of 3040	2876	cmd.exe	29
PID 2876 wrote to memory of 3040	2876	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\11.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "11.pdf" -AT "Supports web links" -p2 -fs48 -c255 -mlr-50 -mtb200 -u "http://www.verypdf.com" -AT "Enabling you to easily position the stamp\n in any location on the page" -p4 -fs10 -c255 -mlr-50 -mtb200 -u "http://www.verypdf.com"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3040

memory/3040-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/3040-1-0x0000000000640000-0x000000000070E000-memory.dmp

Download

memory/3040-6-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/3040-8-0x0000000000640000-0x000000000070E000-memory.dmp

Download