Overview

overview

10

Static

static

3

main.pdf.pif.exe

windows7-x64

3

main.pdf.pif.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    0s
  • max time network
    0s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2025, 20:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main.pdf.pif.exe

  • Size

    492KB

  • MD5

    5ae083acb92a7e6dfe29b4edb7ec20fb

  • SHA1

    c12a45b9cf33a1881c34e0e3d469e7d039130426

  • SHA256

    7390d25410ff7cf2690c1d340f46578881687443fd3653283cf3818769bbb848

  • SHA512

    75b23e5f3a1fb90424932a211cbdac7c8c3c078a57d8d6754e15d9bdaa4cd7b58ff91abb36a20639597a149b2aa8a1a4feec75a31233afb02a7e4d303f497f5b

  • SSDEEP

    3072:kMSncRzAOP4g5IdrO79+lHNNqqRPsO98bx0NO4lzv:XSncRlPbI1O7kNPRPp98V0xl

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.pdf.pif.exe
    "C:\Users\Admin\AppData\Local\Temp\main.pdf.pif.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\BACKDOOR.EXE
      "C:\Users\Admin\AppData\Local\Temp\BACKDOOR.EXE"
      2⤵
        PID:2044
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PDF.PDF"
        2⤵
          PID:2596

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\BACKDOOR.EXE
        Filesize

        36KB

        MD5

        cffddc7c3177706625765eb684410c7d

        SHA1

        04d82ea5e2b0e8e06a3284715146e11148209d2d

        SHA256

        39ecab5ce3b3d2049f707937f679015daf7b3bb56a313cf44683d75887511166

        SHA512

        2165e1553c40291f49823e7fac5454d137f1d2170e54c1e237afe62f2fc43361db8dadd4c1bed5c61aed8c4ee4c9a405685f7620f5f25efada7bc33957cb2765

        Download Submit

      • memory/2360-4-0x0000000000790000-0x00000000007A9000-memory.dmp

        Filesize

        100KB

        Download