General
- Target ImpositionWizard3Setup.exe
- Size 27.5MB
- Sample260623-g96wvsbs2y
- SHA256 6c0038fa0222f40c2eeea2aa4a2cec4fdb2ad3c59e133b59d02ca958bd038b95
Malware Config
Targets
-
- Target ImpositionWizard3Setup.exe
- Size 27.5MB
- SHA256 6c0038fa0222f40c2eeea2aa4a2cec4fdb2ad3c59e133b59d02ca958bd038b95
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/uac.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
Score3/10 -
- Target Freetype.dll
- Size 727KB
- SHA256 f608787361ba4ffcfd9055b6722c492e11f76cfc401685445e7eed6b7a93b69d
Score1/10 -
- Target ImpositionWizard.exe
- Size 13.4MB
- SHA256 6dc146b097e6c4854e4b041d416119e02ace34178de0d21ad31655b42cbdd26e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ImpositionWizardPlugin32.api
- Size 1.9MB
- SHA256 b94e1fd14d48e69c16094e3ea754c1065fb3fdb490c558460f3c42d9be62bb03
Score3/10 -
- Target ImpositionWizardPlugin64.api
- Size 2.3MB
- SHA256 34327aefceee6496d7557b90d3c1d760ff52cf9d8dc24440c0759c3817233cf5
Score1/10 -
- Target Placeholders/missing-bull-eye.pdf
- Size 49KB
- SHA256 2207db7798819ee97838e8204b0f03a9030b8283020deca7bb861d7fcacd392a
Score3/10 -
- Target Placeholders/missing-color-bar.pdf
- Size 48KB
- SHA256 632db5beb16d61035592a9a55389f5cb378d369b660ab5e277543f650df50617
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Placeholders/missing-custom-mark.pdf
- Size 49KB
- SHA256 2207db7798819ee97838e8204b0f03a9030b8283020deca7bb861d7fcacd392a
Score3/10 -
- Target Placeholders/missing-star-target.pdf
- Size 49KB
- SHA256 2207db7798819ee97838e8204b0f03a9030b8283020deca7bb861d7fcacd392a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QMLUI.dll
- Size 271KB
- SHA256 284d84522eebc1fbf8650d59decf49da4d23fca2acabeb6e8931202b247d200b
Score1/10 -
- Target Qt5Concurrent.dll
- Size 42KB
- SHA256 38f61bab180719d612a51b9d8770a30542639295b35ff84916b2879fd685de4a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt5Core.dll
- Size 5.8MB
- SHA256 92a5bfb0d83d7012c9b0d7437e87682b1de04538a7ef42b5a4249bfcc01de708
Score1/10