03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/04/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
Size 1.9MB
Sample260414-dwlf8aew6v
SHA256 03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86
MD5 da37319991abd21c7770334e250aaec5
SHA1 427d61adcc12d5dd3bfd20df0f25b3f52e9c811a
SHA512 aef56b8fa825deb3b781268ffcdda8cfbd83b58c2a7214303145826d0e98c7596a789f0542685c63174e7c0168eece7e0571bd296603700657d1fabcbfece4ac
SSDEEP 49152:B2EYTb8atv1orq+pEiSDTj1VyvBaIaEI+c9NXsBxljNvbwO+:QXbIrqqaE6i/LUO
TLSH
T1B695CF1923A4519EFEA7E1B6CA13C607C7B1BC491277862F01E4AB767F336715A1E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2788	ILovePDFConvert.src

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ILovePDFConvert.src

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2932	1788	03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe	85
PID 2932 wrote to memory of 2788	2932	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
"C:\Users\Admin\AppData\Local\Temp\03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NetworkSubMask.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\ILovePDFConvert.src
    "C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\ILovePDFConvert.src" "C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\PDFReaderTxT.html"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ILovePDFConvert.src

Path C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\ILovePDFConvert.src
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
TLSH
T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkSubMask.bat

Path C:\Users\Admin\AppData\Local\Temp\NetworkSubMask.bat
Size 155B
SHA256 d1b3b3c8f089faae7e72f9e48718d42e2698e37da78fb5b776733c15749e59af
MD5 08637aee9e9e3e1c53cf0e036e247595
SHA1 596d26dd8c7f68e3ff14f7ee75c52da5b2c49306
SHA512 0f52b530d94130a0aa84b200894dad7aab61b3a45a4e7bd994e479f7b7414d3887be33ee6c045b672a38537e90524b1c520321da82be2b6f76f3aa029545aeb4
TLSH
T1BEC04C5281868F3E45459A57C5F9554DA5F1095A2A496714DA3DE80D12C540DF792302
MD5 SHA1 SHA512 TLSH