Overview
overview
10Static
static
4HowToBeatP...ci.pdf
windows7-x64
1HowToBeatP...ci.pdf
windows10-2004-x64
1NEW PAYPAL...14.pdf
windows7-x64
1NEW PAYPAL...14.pdf
windows10-2004-x64
1PolishPaypal.pdf
windows7-x64
1PolishPaypal.pdf
windows10-2004-x64
1Profiting ...i.html
windows7-x64
1Profiting ...i.html
windows10-2004-x64
1ScrewPaypal.pdf
windows7-x64
1ScrewPaypal.pdf
windows10-2004-x64
1StealthPaypal.pdf
windows7-x64
1StealthPaypal.pdf
windows10-2004-x64
1The Ultima...de.pdf
windows7-x64
1The Ultima...de.pdf
windows10-2004-x64
1Unlimited ...ut.pdf
windows7-x64
1Unlimited ...ut.pdf
windows10-2004-x64
1Yasuo.Payp....5.lnk
windows7-x64
10Yasuo.Payp....5.lnk
windows10-2004-x64
10files/Yasu....5.exe
windows7-x64
10files/Yasu....5.exe
windows10-2004-x64
10paypal stealth.pdf
windows7-x64
1paypal stealth.pdf
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07-06-2024 19:08
Behavioral task
behavioral1
Sample
HowToBeatPayPal-preci.pdf
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
HowToBeatPayPal-preci.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
NEW PAYPAL CASHOUT 2014.pdf
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
NEW PAYPAL CASHOUT 2014.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
PolishPaypal.pdf
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
PolishPaypal.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Profiting from Paypal - TCF Wiki.html
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Profiting from Paypal - TCF Wiki.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ScrewPaypal.pdf
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
ScrewPaypal.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
StealthPaypal.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
StealthPaypal.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
The Ultimate Privacy Guide.pdf
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
The Ultimate Privacy Guide.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Unlimited Stealth PayPal Acts and how to Cash them out.pdf
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Unlimited Stealth PayPal Acts and how to Cash them out.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
Yasuo.Paypal.v4.5.5.5.lnk
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
Yasuo.Paypal.v4.5.5.5.lnk
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
files/Yasuo.Paypal.v4.5.5.5.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
files/Yasuo.Paypal.v4.5.5.5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
paypal stealth.pdf
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
paypal stealth.pdf
Resource
win10v2004-20240508-en
General
-
Target
Unlimited Stealth PayPal Acts and how to Cash them out.pdf
-
Size
51KB
-
MD5
8cbcfd4f65421379598628918a5c6048
-
SHA1
cff70e9a589452810b997081c7dede8c30163e40
-
SHA256
29426b26f770333e3ce92e61ba0e6c6508679655a023ec64185c32e5ec534821
-
SHA512
accb1ac7e99c3b65d7d72ec5365271ff01fb04ef02b07806a1da1f52371c141bd46cdaae3920ff01940656fd8d94b0bc1511b976a7059d5f4c43cc1934b931ce
-
SSDEEP
768:uN2QunEdL3/uh54q+gideO6Jd4irWtuZbMLCpMfEnOZz2BhGSc0rfpR5j9BktMwc:utL3Ghn40BWMZ41s/hjc0r1xBktMwuSu
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid Process 2224 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid Process 2224 AcroRd32.exe 2224 AcroRd32.exe 2224 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Unlimited Stealth PayPal Acts and how to Cash them out.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2224
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD571f706ef1e5271a03dcca7749210506a
SHA1cdab7bd73f8cd0d5995b2bab1f235b9d32d86571
SHA256827455c72c44e71a23cc624efd75c5a5a48c92cc8ba83e02b2e37f811406518a
SHA512f28f27cfc7235b50ac6b00acff94f752c1218f193afa7c8c58e0076c5bea31c6e093194efc36dba4e8b52e5ddf19dda444b3cef1ffd7cb70c0abd40a0341da03