05d455867fa1e34de144614d80bcf7b0ab099e7be432e1b99f4acd9a0ff52b69

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 00:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PDFCORE8.dll
Size 3.6MB
Sample260421-aqs3bsat21
SHA256 05d455867fa1e34de144614d80bcf7b0ab099e7be432e1b99f4acd9a0ff52b69
MD5 aad23461497d18d326547f5da7bb8410
SHA1 d7235c7faa01c9302a91e5826a0fa03b8c3a9b77
SHA512 4ecf16d47f9ed29eaf300ade5c22497a947271f318e8dc48c5c2b07d764e3af55285e81be19607cf2445b78bba89ec1f77b4b0f22aa48f74da0b62aceb55c2ea
SSDEEP 98304:PM6K6Y10xm8UjNF44IEdVp/DRE3Dnj+bgQe3EH:a6TxQIEfp/DRE3Wb+3EH
TLSH
T1F306CF127CE1453BC1AB03704A5EF37A36FEA934032685E763C86F293D709E26639657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 576	1112	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PDFCORE8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PDFCORE8.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-0-0x0000000001380000-0x000000000145F000-memory.dmp

Download