Behavioral task
behavioral1
Sample
a9d5ad2a-9d38-4b2c-b3b6-c9e97017ba20.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
3000381523930_.zip
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Пульсбанер (1).pdf
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Ц_1_29867-24_26_09_2024.zip
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
лист на ТОВ «НОВА ПОШТА».pdf
Resource
win10-20240611-en
Behavioral task
behavioral6
Sample
лист на ТОВ «НОВА ПОШТА».pdf.p7s
Resource
win10-20240404-en
General
-
Target
a9d5ad2a-9d38-4b2c-b3b6-c9e97017ba20.zip
-
Size
6.8MB
-
MD5
c0b2e804a138ae0a0327d4b96ad9bfe3
-
SHA1
f644337ca4a57bad2ad8d63d1b87d35505d61f51
-
SHA256
a942b9a227aa8468cf0b6848d961a4a65b01b4c522415950ac24363bc97169f0
-
SHA512
ee81c3df6363637a04112b3eb49a39d1ef83decf67398780046b078cdad225c92becda4baf2e6e973681c9d99f0808854ed8903cd4191507f01cd006934060e1
-
SSDEEP
196608:kLVhEDbaP3C0sBD4LrzmEv4/+xEKyluiz:kVDP3JO+2EvLylFz
Malware Config
Signatures
-
HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
resource yara_rule static1/unpack004/лист на ТОВ «НОВА ПОШТА».pdf pdf_with_link_action -
One or more email addresses in PDF identified
Detects presence of email addresses in PDF files.
Files
-
a9d5ad2a-9d38-4b2c-b3b6-c9e97017ba20.zip.zip
Password: infected
-
3000381523930_.zip.zip .pdf polyglot
-
Пульсбанер (1).pdf.pdf
-
Ц_1_29867-24_26_09_2024.zip.zip .pdf polyglot
-
лист на ТОВ «НОВА ПОШТА».pdf.pdf
-
http://www.kyiv.dsp.gov.ua/
-
mailto:[email protected]
-
-
лист на ТОВ «НОВА ПОШТА».pdf.p7s