18627987583[.]zip | Triage

Sharing

General

Target

18627987583.zip
Size

133KB
MD5

72b79bcb371e6d8e5d590de43377006e
SHA1

1766fb7ce8f7b903b15b9e6411a75a46502f1738
SHA256

03bd111e8791f0f233329706a76c5a28805ae6fd5d474e78b79ff7ec629d9bb0
SHA512

67668de355395c7eb136bfa053647d02bef8344d72aada489f6d8d9ad0d509b41c4ce74106abc14d92ffd46dc9c501f7cd3e348565584d4800fa5fff14bb9ccc
SSDEEP

3072:CMIQz3vs4IyFKyLEyJ89XPK8r3g/VM/1k5iGkLVCG9ApL:p3v/IoBoiItg/VU1wkJ5eL

Score

6^/10

pdf evasion link

Malware Config

Signatures

Malformed or missing cross-reference table in PDF
Malformed or missing cross-reference tables are often used to evade detection
pdf evasion

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

resource	yara_rule
static1/unpack001/db1824cfc4f035ed0dff652235bc91261a4ab7d01fe974839091a2cea26910a4	pdf_with_link_action

Files

18627987583.zip
.zip .ps1 polyglot

Password: infected
db1824cfc4f035ed0dff652235bc91261a4ab7d01fe974839091a2cea26910a4
.pdf