Overview

overview

4

Static

static

3

Hemingway ...om.ps1

windows7-x64

3

Hemingway ...om.ps1

windows10-2004-x64

3

Hemingway ...or.exe

windows7-x64

3

Hemingway ...or.exe

windows10-2004-x64

3

Hemingway ...m.html

windows7-x64

3

Hemingway ...m.html

windows10-2004-x64

3

Hemingway ...ell.js

windows7-x64

3

Hemingway ...ell.js

windows10-2004-x64

3

Hemingway ...47.dll

windows7-x64

3

Hemingway ...47.dll

windows10-2004-x64

3

Hemingway ...eg.dll

windows7-x64

3

Hemingway ...eg.dll

windows10-2004-x64

3

Hemingway ...GL.dll

windows7-x64

3

Hemingway ...GL.dll

windows10-2004-x64

3

Hemingway ...v2.dll

windows7-x64

3

Hemingway ...v2.dll

windows10-2004-x64

3

Hemingway ...lob.js

windows7-x64

3

Hemingway ...lob.js

windows10-2004-x64

3

Hemingway ...de.dll

windows7-x64

3

Hemingway ...de.dll

windows10-2004-x64

3

Hemingway ...p.asar

windows7-x64

3

Hemingway ...p.asar

windows10-2004-x64

3

Hemingway ...cli.js

ubuntu-18.04-amd64

3

Hemingway ...cli.js

debian-9-armhf

4

Hemingway ...cli.js

debian-9-mips

1

Hemingway ...cli.js

debian-9-mipsel

1

Hemingway ...dex.js

windows7-x64

3

Hemingway ...dex.js

windows10-2004-x64

3

Hemingway ...dex.js

windows7-x64

3

Hemingway ...dex.js

windows10-2004-x64

3

Hemingway ..._mo.js

windows7-x64

3

Hemingway ..._mo.js

windows10-2004-x64

3

Analysis

  • max time kernel
    1s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240729-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    21/11/2024, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js
  • Size 514B
  • Sample241121-pmlamsskf1
  • SHA256 76d3e194796ca30c3842ae08ea868076d1e820930e1b1743680a9f42b9f148a5
  • MD5 SHA1 SHA512
Score
4/10
antivmdiscovery

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js
    "/tmp/Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js"
    1⤵
      PID:776
    • /usr/local/sbin/node
      node "/tmp/Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js"
      1⤵
        PID:776
      • /usr/local/bin/node
        node "/tmp/Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js"
        1⤵
          PID:776
        • /usr/sbin/node
          node "/tmp/Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js"
          1⤵
            PID:776
          • /usr/bin/node
            node "/tmp/Hemingway Editor 3.0.6/App/Hemingway Editor/resources/app.asar.unpacked/draft-js-import-html/node_modules/flow-bin/cli.js"
            1⤵
            • Checks CPU configuration
            • Reads CPU attributes
            • Enumerates kernel/hardware configuration
            • Reads runtime system information
            PID:776

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads