Extracted

• • Target

    38f8f20eae06e575938ffbeb64e31c9310e8c0ab50a2bc231f3aa9777abc3dbc.pdf

  • Size

    16KB

  • MD5

    e51378e49d1aa79ce88c018d748a186c

  • SHA1

    d2e31a96af911a0cf932ec860ce839e254fbd5c8

  • SHA256

    38f8f20eae06e575938ffbeb64e31c9310e8c0ab50a2bc231f3aa9777abc3dbc

  • SHA512

    0f28b75712bcc9307e8bfe0b9c692cf1f582c957a718dde3eed7485c4e050075ef45ad49f57ade1536ac6b4c6418a26656318bc630156936892fd2c999fa0604

  • SSDEEP

    384:9q3MsrhjEN4gQ3micNexY27IEPCUSkSaHTeOHAgJlATCUSN:9q3prh04d2aFU2dHTDHv62

  Score

  10^/10

  bumblebee1discoveryexecutionloadermotwphishing

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw
  behavioral1