0ffbf11d10715065c7dd1a212a644e0f54ff95c18d3e8d9f1b381e89e10f4cc0

Sharing

Copy URL Twitter E-mail

General

Target
Sketchbook.SketchbookPro_2026.615.1607.0_neutral_~_k9x4nk31cvt0g.Msixbundle
Size 124.4MB
Sample260623-3dnajagz8x
SHA256 0ffbf11d10715065c7dd1a212a644e0f54ff95c18d3e8d9f1b381e89e10f4cc0
MD5 3b33821a33ba24202fcc5166ac83a65b
SHA1 dbe466b351ba7f5ea4a3822e27f61d4549cf5535
SHA512 dcfe31378966e38c5e1f99202b13ead19abd3e782ec83eff39a40c2bef4dbfa386396ecd0153698b5d8f6e4acd32df39c4b2ba72b1ecd87bc7106b161ea8e3bb
SSDEEP 1572864:zjYHZguFduKsTgJc90bh1k18/D8N3hO0YHZguFduKsHKHFU/lfP+RokBSBF+NssM:zjY9dosvbOMDKhO0Y9dfHFzK6IFGs1V
TLSH
T124583394E39C0CAFC17B9C39569B58A2011E31FDD467F48531A53E086E8419AA1ECFEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  SketchbookProInstaller_9.4.7.0_arm64.msix
- Size 60.0MB
- SHA256 867bf13b6121c76ae41a1eecafa2c488488003ac234264e99c64ed8ea45f90ad
- MD5 71d9ef50c97bafd8da7a26e9cf1412b6
- SHA1 bc378f7fecd8ab452bd94d77c775e7bcc8c20846
- SHA512 f01a1b64a433c10296776981ef94fe77edf4145f7b8b3701efc0a4e90ad2af80015ad5ea3df727eb093a653b30fcdafb6bf1c5232b0306a83bff0ed15ce79cc5
- SSDEEP 786432:YjY+gZU/evFUkYDNmaqiLaslZwvjgo128onbBfOrvCGQ6hVhFr9i5IyI5hQVosbS:YjYHZguFduKsTgJc90bh1k18/D8N3e
- TLSH
  T1C2D7335473584CBAC17F8C3DA6CF28E6010D31EFD46AE15172EA39485EC911262ADFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SketchbookProInstaller_9.4.7.0_scale-125.msix
- Size 78KB
- SHA256 a1cd72c6250258da9c55474aa1f1c920149c0534b1db0fe35ab9de183eb24fc7
- MD5 8712033d1c355162f1013717323940c8
- SHA1 3cb437e39cb6544a0a587c493c9e212e6ee7d2cb
- SHA512 2ca18df8176b428019b46e1ead58a7c6a32786415aedf691b126ea5b168badc377c0460b61b4c9ea0a897604db74c889a417c23a6a01c9819d9214e33cfb5ddf
- SSDEEP 1536:DmwyGTxa7gBmhI6zgyyD1SXtE42qAx9kz+0FkPaDs47dGPfA9+RGF8TTNbB6DSMG:DmuxK+mndO1Sd3Twa+QkPaDV78f5GaP/
- TLSH
  T1A58312DBF22CB04AE2799B79463ED15A0D1E2C085C0719BD08A5B63D3C91EF4A6CD1DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  SketchbookProInstaller_9.4.7.0_scale-150.msix
- Size 92KB
- SHA256 ab47642908e5c8619a40bee62f98f76ee85672a18f2c937fcb6ec99755d3d03c
- MD5 8528841967ad83aa3e4f8c918439265d
- SHA1 f3de409f73cef2795b484f9c97e9a648336565d3
- SHA512 c55453a14e4394fec0d2cc28ff591f972d928137b19556f3aab32ac3e953cf0ffb9be84d7a9468f41e8c90f4c6c390275cc244a3cab2c911196cb98fa6aacc5b
- SSDEEP 1536:rzuAPQAUJHEGSZuhghZ0Wt5+FEIIGeaE/bUkKdOaWOqz2dOPi8VTigsdMo/:rKAPQRREGSESEEweaEgktxOqz20P7Vmr
- TLSH
  T1CF930256C8112C57FE3825FB981630900C36969060973EBE742CEFAB9F98F458623D6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SketchbookProInstaller_9.4.7.0_scale-200.msix
- Size 124KB
- SHA256 7181fd8f7ccb06dbefd7aa04b0623cd9c522715bedd1c06d5ce8144ecd0ec412
- MD5 28c3a099b50b010c907640abc0435c63
- SHA1 180362487b10d43e49b77843e6942d37b5f39b83
- SHA512 9e6006cbe3b96f98c231306ea239e383ce24004f40262163149e917ca77e99de131b110eb3714b63e614fd34c13e7b7a31d0156498b5419f6fd661e5247d7116
- SSDEEP 3072:MRB7P7DG65ayg+l4rndoIbg2lDO0B4qNI1pF6086F3baqto+gKIqdq:MRB77Dl8n+6j6I0oDO0B4qSpFH86BbaF
- TLSH
  T107C30219C25F7BBAC801CC3A7F6F851070236D93B57B527A55652C35386AE8AC8D390E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  SketchbookProInstaller_9.4.7.0_scale-400.msix
- Size 293KB
- SHA256 41d8e418c5e0dfa3d63f2f125cba66dd342de0f0203c51b8bdabd7318aa122c9
- MD5 0b859c13dfcc8b75cb5014f473351485
- SHA1 43edfb985e556e4436b89e8f0847a95696746791
- SHA512 2953fbf00df15dd2547e64bb1f651a1ee68155582a71e2623384a7e36a4e608a9518a9b577a3c44a584615b191bd316007b3fe47dc4f45d62536986e694b5c80
- SSDEEP 6144:QcFNRodOtCinzvsQCPrhH0nhnjDySwKO1/6DQAMsohInjpgOsjjIiA1O:jFNRwgCinzkzJ0h/yl1/6DDMsoUpJ0j3
- TLSH
  T12C5413FB54F24C09EB8B143CCF662FADAB2F3DE8D6C58347272E75955C06A4E6894201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  SketchbookProInstaller_9.4.7.0_x64.msix
- Size 63.8MB
- SHA256 d7f37925c52937c845b16a76ac95d947bf4a711e61539a1f80e14c9c61b4e967
- MD5 5cb920f5698049cc05d0dcfc662e338b
- SHA1 747d847341b9ec718af4d5a3802e8e3585f9897e
- SHA512 28842d4b8b1c5ac762a2eae554dc041ad28144b4c5e89e432c8faac4e5e66bbb5f6afc226a2f1a05f632b5f8864c21baf1503360b553b41d4c37b1510506bfe5
- SSDEEP 1572864:MO0YHZguFduKsHKHFU/lfP+RokBSBF+Nssi1a:MO0Y9dfHFzK6IFGs1a
- TLSH
  T1DDE73384D79C0CABC2AB9C761552C892011E31BCE17A74CA70B65F14AD442DEA5ECFBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SketchBookPro/qml/QtQuick/Controls/Material/qtquickcontrols2materialstyleplugin.dll
- Size 1.1MB
- SHA256 d7fd7932731ac3a15511df4ef943a17ce4e8f4a21d901a2e606e1995cbb1b019
- MD5 9ecff09c3d63c39b40e958f869a5e166
- SHA1 c47762edf5cf31fae279e8fe33d10ebd6a2ed963
- SHA512 7cd564e469b71099866bef54ca61d757eea14e7066b8b2a05fe03a21d2577c45ec4f6449f1ce1aa0971216fb6a7eb75705cdd31a064121bda60f272dcc537f63
- SSDEEP 12288:dApAJZIHQgp0nY69+QQz/US7OF0Ut8yTBT/ML/S/JlaZmmqXE6p2ZxTanyFy:duAJZIwgunm/Gy2niy
- TLSH
  T1EC45A5B767B98259F3AAD130C9674212D2B3B815ABD1828F712DD61C0F33B831D76726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  SketchBookPro/qml/QtQuick/Controls/Universal/impl/qtquickcontrols2universalstyleimplplugin.dll
- Size 117KB
- SHA256 ff885ba6b482d3f24fead7c24dd10d2c8691b081d6761eed1bdd904e56ea86a9
- MD5 badec452d69310b0bea6b987dafa623a
- SHA1 558d75dd5101ce389bab15558e0340d4755172f1
- SHA512 60b65895bd6fad7b7ba6f4aafefc80602eaab8d7bc693032344825c7701944ea7c49865d81d33683be65b89837db062cb8e7e16526a42b457a49f020c40dc232
- SSDEEP 3072:nYrCLZDB1+5L7QnuekaXkbW+uUdOBeoK:npLZD8ge
- TLSH
  T1CFC35A2B2BA60197E166D138C8930E12D3B2F58537929BDF2264865E1F733C35DB93E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  SketchBookPro/qml/QtQuick/Controls/Universal/qtquickcontrols2universalstyleplugin.dll
- Size 942KB
- SHA256 4e9fde1f7d3d5052ee105ffbd09b115a866239de02b56c947d540fb38e0e3b15
- MD5 74b714cf2b1938b8a22c737bb0a15b7a
- SHA1 eb70b97b064040595d45ba9564f3e95f2c7c1014
- SHA512 0cb1f1fe5ea30b29dd6028efde742f43202f3243d41cc44eb318f2e6da039a081eb1dc96f25164cab13679c2af157d812f78f32d5cb272f8eab3f1a7ce574967
- SSDEEP 6144:Yc744VT9L8s16+PN39kxufc84yYT6vzL88zXij2WeDH7zDB3JA:Yr4VT9YM6WN39kx/yYmL8kSy5DLB3JA
- TLSH
  T12225B57767B58259F3AAD530C8674212E2B3B855ABC1868FB12DD62C1F737831C36329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  SketchBookPro/qml/QtQuick/Controls/Windows/qtquickcontrols2windowsstyleplugin.dll
- Size 182KB
- SHA256 6102156d6f9eaea6f2c35ac062a12c7f875140e46acbeabb82b44f6fafa65850
- MD5 736fc51b99a9ed0ee504f6a27a3ff7c5
- SHA1 700c890436be97c1ed1bfb8456227ed203d0d633
- SHA512 99a2f19bf183ec4d4652b5b9e58fc56c05c739b286ee897ef3a9ddb16f74705ec3fcfc2f4a0ae64428097ddd47b77b660a28ab6ec242c4d1f4335a3f0394b215
- SSDEEP 3072:57S3nO50f8Tn2iTsQOH/BEf+XVfIJYElP3NWW3uyKPm:57envfC25AwIJTf0Pm
- TLSH
  T18B04C52627F5429AE2A6D170C9A64212E772F855BF8183CF312D963D1F337831D723A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  SketchBookPro/qml/QtQuick/Controls/impl/qtquickcontrols2implplugin.dll
- Size 31KB
- SHA256 0e69262413aa419f0dac69618128671682c6dd85b98b1848c57b6240d956260f
- MD5 2bbd723fb7995cb5f6255a7471670978
- SHA1 e99719f2efa1920622a4e686378379f6a130ddd0
- SHA512 3b3a71167a1416dc689fcf9afe26c2fe5a0349ef08a6731a992fd307af20bae4f84ef8aaba0628843cb5fe51b38ae051632a30695579368e701777e9f1ea9890
- SSDEEP 384:9kPifu3Nt8CJ7RwY4YpeUjEFP27xWkVbGW/JrpWeYy8RbmL4nNyGUy:uNqGWCeYgKxnVbGYJNg5ALUt
- TLSH
  T1E1E2AE8699885592F06ECA34D4E78E26D876F262BB82C7DB2221016C4FF23C13DBD755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  SketchBookPro/qml/QtQuick/Controls/qtquickcontrols2plugin.dll
- Size 40KB
- SHA256 deb4bf714fe9c3c948be923a010d4897fffb28308ec08684c7f67f570eaa5925
- MD5 9fe88bea0960a27f126b4446b33a4727
- SHA1 4af8545313fe747cd105dd13a3677a9c9f795866
- SHA512 de6e02d7462f70175d1c380f68925a97617ea728eb6b3d0eb1d751a30f75c32453f625a50ddbe9015412ea31c38e03d271a013fa31b7d3cca9532d5689283fe0
- SSDEEP 768:ByWOebFBAnfkavTs6XcgKxnVbGYJBOq5ALC:ByWOeb/AnfkgTTXcgKxngy
- TLSH
  T16D139D5253A80981F47BC638D4D54E1BD8B5F2603723D7DF9222022D4F723E2BAB9B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  SketchBookPro/qml/QtQuick/Dialogs/qtquickdialogsplugin.dll
- Size 30KB
- SHA256 127a7039742e194a4da6c8d20e1d0209aa29900452bfa6b2727bc06881ebd6dd
- MD5 3b917f2a5b79119adb27a8b53816ffd5
- SHA1 d3664c87fff1ab7b5e10fd132ce7c587e8274c91
- SHA512 80ba0ad81d2d53c5f0f84c5c9015491e481a7d43b7138961346c3bf346bc9bea6c69324c2802844ea038196340995c1ecacb42805735d7b8a91c6b71265d08a9
- SSDEEP 384:bkNRHVzHTeejRwYh/yPSEFP27xWkVbGW/JrpWl89y8RbmL4nNyNt1J5Z:GVzze4f/aSgKxnVbGYJNJ95ALxf
- TLSH
  T1C4E29E86A5889462F46ECB30D4E68E2AD975F651BB82D7D72220426D0FF13C23CB9794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  SketchBookPro/qml/QtQuick/Dialogs/quickimpl/qml/%2BFusion/ColorDialog.qml
- Size 8KB
- SHA256 7702a8985ef38f4c6661fb53657ded3509e6d79ebf11ba0163c27de2a99610a9
- MD5 5f08d4f833c82ece5f529acbcc754fb5
- SHA1 5441808e0d33a651ab1b844e849e75475a0444e3
- SHA512 bbf585478242c27674537c8d922b917d1b2bc49ca3d36606ad2c2f2ba7f9c4290272dd3ea638d92040f3d501de5a62bead96722d28daaa82d180a04accf1c204
- SSDEEP 96:UaG3vn3L/pXThjobTixvQeUu3Fzr+3/LqOmyC1e8eJvCGB2M8Rr8XrLGn2SQ:UawbRFzxYeU0r+PRmM7JVXCrA+k
- TLSH
  T196025645A1242122E533EB79DDF2DA5CF763A323B60089997F9E87C04F74841A1D2F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  SketchBookPro/qml/QtQuick/Dialogs/quickimpl/qml/%2BFusion/FileDialog.qml
- Size 6KB
- SHA256 1dcbab84b9427e8e5bdaa7e059c62c0be39f6eda6cee4954414a94df46ffb051
- MD5 171387ed29778350a54f32467f1382d2
- SHA1 17279435f737ebc42b1ae2905b0fc7f04c2ae54f
- SHA512 38d222e03698da3a443c559618544c095a7d24af2a1381c5341fb0688ac868aa3ffaac3532353aa18d1890e3e6bc9c2205014416d3f7ad21f183887d40887b37
- SSDEEP 96:ysaV3vn3L/pWW4x9On8nWCJfKQOnobfiW8Or5vD38jUYpFcqj1UH5/tzh:ysaZbRixcnIrGNW55L30UwLKH5X
- TLSH
  T177E1524552392160D9B6EB35FEE3A19DFB23A0676210845A3E8D83801FB444CF6C378E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  SketchBookPro/qml/QtQuick/Dialogs/quickimpl/qml/%2BImagine/ColorDialog.qml
- Size 8KB
- SHA256 2104ca8e609b9c3b363ae96a510a63c84492dfdcf2f5f33aff49ccdbfdf56f0f
- MD5 e94fa7e66635fef7830bf8dc793dccb9
- SHA1 155d41bdf56ad0d26d4e6943d0d98c70e13cf929
- SHA512 a8c58391397c94f2958310054a2534381f77ec056e31d0ee50a78078fe733a78cc05a203e69caf0d41127741448c7ba152a28198562cc29eabb8282684fa01dc
- SSDEEP 192:UggybR4T6EwS7bhpiFeUcr+PeLLDXR8Crg9q:Uc1FORSI
- TLSH
  T17D125249A5641132E633EB75EDB1DA1CFB63A323A100CCAD7AAD47805F7468191D3F4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32