Extracted

• • Target

    Acrobat_DC_x64_VIP_v10.12.msi

  • Size

    2.7MB

  • MD5

    b9632555b2c19b9182cab9c098c22d8e

  • SHA1

    100d612540c51413141f52c3888114cddb76e9a0

  • SHA256

    1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2

  • SHA512

    b90b26af09115c4ad37f5cb40135de51835ccffbd666168934062fb587a9111fa535e21c1e231aed76a5e871d63a9f71b686367defed3d584f6d76f75e5acb52

  • SSDEEP

    49152:/O05mqQDiCjwnwVv+i2MF/NtSftHFDSy4dx21N+NfSf/wXoCBBUQZcUJ8+mp3gi/:/rABiCjwnwVmGF1t6R1j4dx8Njf/w4C2

  Score

  10^/10

  bumblebee138704discoveryloaderpersistenceprivilege_escalationupx

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2