4a03f53c8227329308c82fc4f88b26552c0189608dbe5a3ad5cb317f7f1afcbc

Sharing

Copy URL Twitter E-mail

General

Target
provinv.zip
Size 10.8MB
Sample260604-pflmtsd141
SHA256 4a03f53c8227329308c82fc4f88b26552c0189608dbe5a3ad5cb317f7f1afcbc
MD5 d6b7a09248d778b9415b24803df6fbf2
SHA1 964c12958a6186080b625234394e6a89a25eb6e9
SHA512 fce02713364d308508aed8c3710016d6dd6cba0cb89068ebca53d5c37e4352df6c2f72ab1ab8d1df7b5bbacf5694367dd3246553e5f0270a73cffefb0f32b136
SSDEEP 196608:dFgL0sopQTLo4I0e1CP8lhKjqiDCgFjpoJQUCo4Iae1CPNEhKjqix:kL0hpQnM10qWFjiJQ5+30qS
TLSH
T175B6337E7D61A22FCF2CD23176FFDE2101C5849E1016AB994935AF5E39FC58EB091A20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  provinv/images/hexagon-green.svg
- Size 649B
- SHA256 ae13d3ddf6bb44aff98c18be1389b54568038c3703c2530f637a5981f43d6768
- MD5 9dd958969cedb406d2980582fa341e54
- SHA1 ccd95d412696a92a7449331f9c23a5efa1d6bc92
- SHA512 f4e14d92e5bd31b0c2ce433f3187c7dc99449c16bec4063fb44c7dbe84ab5e875a3ee4baf401f5552241d4eac7a0499fcd3c3f154a914ee6a37ad62bcdd20aa6
- TLSH
  T18CF0D34682059C7E6124821097E866C273F8B589D1D449CCC9E62C3FE2259D0521D9D8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  provinv/images/hexagon-white.svg
- Size 489B
- SHA256 04c942c310c2f97ac4a8f0c46d67c240e24a76e97aadb84622d777b0fb714cb6
- MD5 93ad96e270049decb3bd1fd7042480b8
- SHA1 ecc04882a4486f331a411d784e23e750299e2298
- SHA512 901f1eeba1a675ffb23d021fdf97940ae9193e168e1d2be0807c451c007c1c46e2191ccd977b7d5c225c9af807e644fb682264ba44feafeed0ca5314dcfd1c28
- TLSH
  T17EF055FB911938CE91E84FE84580934192A96260BEEB07A4ABDF642F6918463607D0DB
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  provinv/images/logo.svg
- Size 3KB
- SHA256 ef2501fba3fa0d6979aafa5277a9266775abcdce8fb33765f1594ea776c31861
- MD5 5e413c9872b1ddf1b7b9644ec73faf8f
- SHA1 16a88999d3f7cd1a3ea94c42f277d7d09d81457b
- SHA512 4070f2636fd26ca378f582f041654d3700f1fc6380e09cc2fe3595019316a70b0d2d2283b5a6d20523adcda85ea9ff8b5328e43a00c2256e0cd200f81904b58e
- TLSH
  T12871AC570740E7AABD5601A8A97405EA73D6CCDBC0B0F2C49AE6B802E90ECD456DC5FE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  provinv/index.php
- Size 59KB
- SHA256 90be2c5f54b92da747f93701d47ed6a2693300c3371f69c5680c749473c9b26c
- MD5 8ef8e3ec40340674bc07f238b64a578c
- SHA1 80479abdc1667cfb70c8e3f1e04f639d8d2c2350
- SHA512 4f05476c2c504b10ca7b467bbd82f2db207c21127a3bbc28e6af78d4b00e9bf82383ab37555f5eea472316b0fba7a245fc26073f9aadabaa5aeebb91fd1b9de4
- SSDEEP 384:dVteRqPFgNkb57HnU6iLCo9eipvgYXCOZRSyf8KNMrVHRxqpvpiJ4ATX2KMfXGFh:5eRqdgi1HutvFfDCheA72uiOrsWi0
- TLSH
  T174531D212AC5103342B382897A755F5AFFD4C62BD74B9A5175FC27AB6FF3C108A27248
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  provinv/js/bootstrap.min.js
- Size 56KB
- SHA256 0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
- MD5 e1d98d47689e00f8ecbc5d9f61bdb42e
- SHA1 6778fed3cf095a318141a31f455c8f4663885bde
- SHA512 021e615983f30ec5477fd8b611e8c5045ac6d9900f9a9bb8649b56e0c7d282965a727f8cf501c3b7e1ddff02f5b44924d5481bcea7a926be8a9e166314a07ed0
- SSDEEP 768:5NYyDyKAmHVaS3m3Dqp0NwCkXDtdFDLmTV+miDNJcJiQMRqyPiYtB6UvcCg8YGk:5NTKktDLmTF8yJL45XtHjoGk
- TLSH
  T11243C90A725478B205DF9176917F420BB737688AE94AC16CB91D98ED1E7CC893227F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  provinv/js/isotope.pkgd.min.js
- Size 34KB
- SHA256 081ae9baaacc857c1c2cb51de6dbd0e1eb811c2761ef01a50df373f2f6eefe22
- MD5 2afcff647ed260006faa71c8e779e8d4
- SHA1 c4e5994f24ee8c8d2cf2d6602f0b56b9096a2e98
- SHA512 66ad813b1ca1be74455eed3e584ea88e964b394da3767a9baccd61995746cf27826b50e03375f943803f22cf710352246d478377bef9e5d34d23f3f349fd8f7b
- SSDEEP 768:LAyxsGKyc1gfflZVP4eAnmc6FumKSshD6cD6GLQfq9SvDz2A1Fxt:rxVKDSfJP4Nnmc6FuCshD6cD6xS9ODzV
- TLSH
  T1F3F2D84F73403925468BF166926F160FB137A56C6A4790ACBA6AD8DB1C79C0D6033FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  provinv/js/jquery.easing.min.js
- Size 5KB
- SHA256 f9b2277cb79f77cfa984fc713bda988da89f9699509a30eee234404efa79b32e
- MD5 b62c744f5635480a0eabd225a04b7452
- SHA1 e1fd1d78867a8171c0f69148f350c098e4d4c8d0
- SHA512 e6ef407ddfce56189c65c711a349002297d7eeabe85ca9ffd49b4e9e4f915bd22f93c3bae561ec61d366b0381eaec327f528ab24ec66b266bdbe6dbb0802fa1e
- SSDEEP 96:uBm7aaOr8uroJzDV6u3R3zd4jAzY4JTqhkibwERICsTEDW8:p+aOr8ur83V33R3hqAqbwgYC
- TLSH
  T136C1FD8D30F6A29D53D137F45066508BB25E9CB9160E2406ECF499C9BC3B66C877BD2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  provinv/js/jquery.magnific-popup.js
- Size 21KB
- SHA256 ca682da05f4de47c26f8d1bf8a2604a9d7c61ab60d20860e0c883099a29f07ac
- MD5 7790b276800430f76800dcf5c23975f2
- SHA1 07827b88639608e31a913e8985c87081ac7eb542
- SHA512 1d9ac4abb31b3a9103077da421eefc2db14d6dee3e19904b8f8a90d949de5210beba05b39833c90744c9bfed947b518c3e0d57c1861ad5fb9360376d41a0a9a3
- SSDEEP 384:0HVsEzAY+Y4JhOcXKMFWTZ0GZX7IB8/BNdpZU36bI3q0SPTdx:uVDCaQ1lq7IibnZO0AEdx
- TLSH
  T1D8A2D958F0B7E1DA8BE634ECA61FA44965739437950A8463EFE444981AF8DCC7036F2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  provinv/js/jquery.min.js
- Size 84KB
- SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
- MD5 a09e13ee94d51c524b7e2a728c7d4039
- SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
- SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
- SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
- TLSH
  T1748319DD72C6B06247AB71BA00BF550BF2361999684D4410F129E4EABC74B4E823BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  provinv/js/morphext.min.js
- Size 1014B
- SHA256 a86df3be0eff7f90991f057c21e6907c16391e6f8cd0a4773cc93d9401e9dfdb
- MD5 6db5449e756b858fc376ea662aab817a
- SHA1 384a56b05af02a655286bd9f52a25653aed2a7ac
- SHA512 58f60b041b4b15150a09b8fe3c8ee21d32fd39142fc5ceee86c6fb6c840c2a844f61b8b26dfa08288c49ef29d5c2b1a9b29791d8aed614e0d4493ff10cb835c0
- TLSH
  T19C11E1847387984D0BBB55F5512F170E143350054851926C3A38D5CE69BCD2D717FABE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  provinv/js/popper.min.js
- Size 20KB
- SHA256 71ef7c16d75da75a5d417df75ed72144bc5ec65a9c0429b7dee0988adc3e8d29
- MD5 36affe2ca6cb85233ee7362c5d8b7893
- SHA1 42e3ca1212d825150c0f57f97dea8d9c0b0ce2a1
- SHA512 956279deddc58d615770b3bb096446f2f24005f50eb92b8c66ca6df20da70f2c7f7edfc1f996f98c14a3103e10cb37b8b69d83a9510257d7c7a378f56f3a4287
- SSDEEP 384:kmQkLrwVOyzirVyKnxRsIB9Db5HjiWn8xHOxvRVgD75zBY5vImg3FzGpL9ARdOgI:vLsgyziJp3Db5OxHOxvYD73Y5vQzyL9x
- TLSH
  T1A392B4CC3294B06643A791A7A0AF960FB2339875610E9410F19DF2D97C30EF9A13BC79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  provinv/js/scripts.js
- Size 14KB
- SHA256 66997232aa1f298141ae41f64f5c95b01234a8d32d701d0c5cb552894c19b1eb
- MD5 a0e6abd03a014204b6fe2d16d9e32c2a
- SHA1 8e792f0caba752bf0e3508e8f070b5e05f10a16b
- SHA512 a6c306625071e9fd25e106ad182f53f24cd6ed8406cb0f65e197fc7026d4c39ceff0a9d298730fa328cc004ed91e26d57c533f0c83e43aface41fedf3d09542d
- SSDEEP 192:UjGzQxbCraECZ3IwhFC5Jadu10OWCzEGd16GtCjjS+xuC+czvYKY:U57dZxutF6e+FY
- TLSH
  T103627444B7B626D51233793C96EF9140BB245277A804CC2478AE6DD87FCAF6832727B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  provinv/js/swiper.min.js
- Size 122KB
- SHA256 765d1654297c8d730165fbe731eca09c1d3e6efaa9e7006aaa567c5a2f7994ba
- MD5 74571ff9ea0f905f582197d9e94ab140
- SHA1 2a902def916331df8a60421561e5ed394f42fad9
- SHA512 979d1402dd2a28da875ada4ea14eaeefcdd73f4d6f789f62d49d26d3b33cd1ccaca7733e306924c17bfe54e13a637e9bcc75a73b13ab0281dad5231b0096ee0d
- SSDEEP 1536:p4pN4iK5/lsXrSnTLaK82m9lyu84yjRw5Du644gvpuXvH7WcWUmcPqMj3E8EtObb:jsXr4JHmXk8q4gYfH7WcWUmcPqdVOX
- TLSH
  T11EC31849B35071D551E72256539EC601A3B66845B90AC0A831B2D8DBACBCE8C03BFFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  provinv/js/validator.min.js
- Size 8KB
- SHA256 7a36764fad50aefeda6dc9a7ffa8f37c1b79cab2c00111ab7f7650b26397cdb3
- MD5 06b115e7b21a5c38565a728c6208ffc3
- SHA1 dd3ff164c9e06b75fed5c1180efbdefe809c8c26
- SHA512 6a40d9dfd10c786e25bece19a5acebb4b4bcaeb1969cb71d7ea6e56d5b086afdd425aab6e5eb40df94bbffca821b99f6d5b7626dd38143463f46370a94cadf81
- SSDEEP 192:7JdYMQHRYBy0CWuEvwVa+ODdSDSZ8He52QC1Uzj7J:VtEYU0Cqvx+ODsDSZ8HDQC1Uzj7J
- TLSH
  T16E02414D726622522F9260F4419B818B737A373DD40E409471EE95F26AF8F84B3B7E78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  provinv/pdf/How to verify status of your application.pdf
- Size 209KB
- SHA256 e3e910248a7bc46e1b5a427161f8f1354288a3c2498e765f09688c3a48b9a21e
- MD5 7ee5838552a91fe7c2b17de9a1c9b747
- SHA1 35e79102c072fc1647691e2e6e96df3cb430bedc
- SHA512 71c0065ff75110bdfae0b575ec7de4544ebf519558fd92b2eb4b0407424c87a4110236c236bba2f37cff0a68310b9f9716897d24524e1e584f71f43474bf1a3d
- SSDEEP 6144:NnC53+dcVRkcIXjpLS2QvvLGB9XPuVj+L4AtSTmFH3qS:NnY+dc/IXjpzQ3LGB9XfL4da6S
- TLSH
  T1E7247F078C089B87F52893E8BE175E9C6F5A6B0DE88636FF05524DDB3E116220C9E53D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  provinv/reference-checks.php
- Size 14KB
- SHA256 4560fbe6735c2ad8fbf95ff95eb1797ea30be989ebbfc8ff12670a4d2f22df72
- MD5 1491e6bc7662e70523fc960dab14b0fd
- SHA1 3b4a815151f2edceb44810307e5081ecce444f3c
- SHA512 6898b3c253c17bec92592f0ab4b990a0b03b1e77784bc2f2fd57d1af9c784df4c1a6b121ac0c21c434893e7d0150fe080a282367f6e8b43622fb126f7e17b950
- SSDEEP 96:53/txQCBUTlKkugH3HUUwuXS2omyswuwRH/i+40mEnpr2x8s2y6vc54ass3bMRQF:rypTlvHH3HUUwuXQDDIPfcBchI89h
- TLSH
  T1DC62F21026B840BA51F388DCBAF05A2F7F99CA27DA598450B1FD4ECC5FC6E529B27350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32