2b6ca45da794e7854a6468fd6c8063fde62701f001ce03fa4f603eab7e15a0b6

Sharing

Copy URL Twitter E-mail

General

Target
xpdf-tools-win-4.06.zip
Size 12.2MB
Sample260623-pekn5scw4m
SHA256 2b6ca45da794e7854a6468fd6c8063fde62701f001ce03fa4f603eab7e15a0b6
MD5 1a5068a535b5e9ddcc30d57a96c30e79
SHA1 ae82ca3b1db4c9c1cc0a7578e4216630ae073c76
SHA512 16c120afb4115b1dcc4a93b8e82aaa2fd99a343757a3c191fb7c2ab468cfcce3779cae979f4234c2b2cb07aea74f1f84b1d5fcbca1dfd456a75c6a62c76190a6
SSDEEP 393216:72asARmLhtBBqF1ru3j5RUJjNntwa0lUBu:72/Lh5s1rM9Ctw9l1
TLSH
T11DD633CCF2FD30F596680FF82D774D8D10B141FA9458D89A8FF95A6E18EB940B825E06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  xpdf-tools-win-4.06/CHANGES
- Size 149KB
- SHA256 4b786cb32436c823d9fec1bddf4f6c0376e0048006309e341460a3e6aa08bc2b
- MD5 e0a4024803ac768829805db64060feec
- SHA1 923f76f6d76d8dcd709641253e8f93fdb6f25bb2
- SHA512 f22d73d5d45ccaba94109e26a3d5129517586976f9f796146dbd93c22784717c673bedc589c558b71329c1275198d637b23a2cc18803da616ec4f0cc4e2306fc
- SSDEEP 3072:9WT8eMwLBr4hW3qmUTVEsuXFOp2apKe54i/d:LBwLakG/uXQ0il/d
- TLSH
  T1CCE3D5537A4E237354B28152735FB1F5E32E81B96313A78038AE864C3285568E37F7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  xpdf-tools-win-4.06/bin32/pdfdetach.exe
- Size 1004KB
- SHA256 3c77e20bfed6b7bc804dc0cc80eacae478154feba2ebde33227dc63379cde2bd
- MD5 3e03d4de12d21bace34ddc74b0783231
- SHA1 da33590719c3d3361a87548092ded76bc8482463
- SHA512 ef4b1c275d46b62a5954d5766b7ca9375668005c586b0c1d9942dd9194e86825a9487887cd82f10cd7e5e095255b51d6cd3ffa780b7325d01aadd559295b2e2d
- SSDEEP 24576:MnKvgM8JsdASOB+JGPIDcZ2YJ4hUPIA5xknQWG2mWGc:CM8JJPIDcChBLnQWG2mWGc
- TLSH
  T1EA256C21F58354B2D4410132156AA72EAA38FD190F241AEFA7B47E789E3D3D11F3727A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  xpdf-tools-win-4.06/bin32/pdffonts.exe
- Size 1021KB
- SHA256 058e9e5ba2882382bf68b792cf4ff228701753d11e996a67a425d4649e6a30b8
- MD5 37e25ca4b07199786caae3baea3f73aa
- SHA1 eb0670ffcfaa22c0d2f07357d4bff179c1cdfcdb
- SHA512 133eb7a6729726cc26501ff827ff2a2260d76b7072f0096c415e3c0501385dc7b2e8e174c8915a752e403e833bdb15a5cd03bbc070f606688aaaa6d81760e642
- SSDEEP 24576:WNvzQ9Hfg+7ZFd0cIWYMOFXgLj2bWkqvUPIzbUkUQWG2mWG4:oQxJ7MbwLjxvB/VWG2mWG4
- TLSH
  T1EE257C20F48354B2D5511235146AA32EA63CFE190F241DEFA7A47EB85A3D3D21F3B276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  xpdf-tools-win-4.06/bin32/pdfimages.exe
- Size 1.0MB
- SHA256 84557704118101191a90ba5299af45152d404ab34f5cd5d68be25faf0cd7f507
- MD5 6963ebf3fb35aba3c7a9af39cca9cdc4
- SHA1 542e5c6c800df6f6a948db79e22031597446e6cf
- SHA512 f643e40e43635aba4bbaf9d2eb39cbe60c3f9562d5a1ac67c7c063d4b8bebab2dbf6328df34a3e810baa6ec735a431dcd7b6235384b3ff15e10931d8cdac1ab4
- SSDEEP 24576:mi8khfvkpp0UQldEOx2Hvm3aBiSp3TX3LoBUPIQ6P3GlVF1lVn:0ppLQOiU3wBBNGlVF1lVn
- TLSH
  T1D8358D11F58754B3D0410231166EA327AA3CEA250B2959EFA7A47E785D393D21F3B33B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  xpdf-tools-win-4.06/bin32/pdfinfo.exe
- Size 1.0MB
- SHA256 454fae64b11454af8ef5b647f9270f23e00690541d6e8cfd749dc807db9c1203
- MD5 66642c063d41b78a9649b9d98e07f161
- SHA1 4810ba2e7ae05db7583bd00cd9dc3036bab6fe56
- SHA512 e108de10868f24d5f0f77297ff9ad4d1117ea76b4153638737addf7c4c02a11a2c192245c11ab13afe1840029111baa448f901228905275d4e7475d3275c961c
- SSDEEP 24576:ix4Jv1r8Ud68tehw+ihKGSXGWmtxUPIbxpFQ9pmWG2mWo:ixWr82gMKGSQxBDAmWG2mWo
- TLSH
  T19F256D20F58354B3D0910231196A671EAA3CFD190B251EEFA7A87A789E3D3D11F37276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  xpdf-tools-win-4.06/bin32/pdftohtml.exe
- Size 1.9MB
- SHA256 3da63de2f885a0d37046d2a7f30369b53762eabf8b91b24219d67fc8f7bd8fa7
- MD5 d3959142821d1691b47327ae88eb87fc
- SHA1 9a8240163de56b732a0a70ccba72a9994aab9a58
- SHA512 b7446ce38f68f59ded9b785ac4f2e4e97e05373918e07affd74f77fe2cf20109ba01443dbb3b99e3ed23603157f2ac2c961274b8f3bf8437753f3840a9ddd3e9
- SSDEEP 24576:gHOCyvNENGF/wdk6RJGyvre5+9tNvkz7e27CP68B4TNrI3woKDXWCTyPIFGZDMnD:gzUF/Ee5+lQb8BH3wBPTrZaGhxBAQgw
- TLSH
  T13D959E01F68345F1D5413130112EA72BAA39EB190B2C89EF93947E799D353D27E3B27A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  xpdf-tools-win-4.06/bin32/pdftopng.exe
- Size 1.8MB
- SHA256 856f6e9e2fda6a5f2022bfafb2152e7caa1b9e910e134cad0678fdba89d99266
- MD5 c471e5d01a29dba668a3a30c5eb8c48a
- SHA1 d09261e3b064ce55661807d3115a36b418f56f30
- SHA512 29514b9d43bdd460d6dd82297e395d6dad28f7c4a4280345bb5157fb393c449475a1ff7b27e11c7ccc3df05d823cd1303fba49964212ce84e076e49b0ad43f83
- SSDEEP 24576:qPvasMGJ5Rx2qdYoR/DKHo5KevPuVkMWDTcDm+pptlTrBb7KkjDpUUPI6ZHIPcmD:NIRtuo5KaqBpptD7XUBjPUTSiyCSRD
- TLSH
  T1E8859D00E68345F1E5422131117EA72B6B38EA15372899EFE3946D789D363D22E3727E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  xpdf-tools-win-4.06/bin32/pdftoppm.exe
- Size 1.7MB
- SHA256 7723c1c9e1c298316554309e9124ed1e62f83122b6649f7e15f6a55c68c944f6
- MD5 8f449076d199a4a8bf39b8097fd90b06
- SHA1 1861cd4fb46ab6116835a0105bec943656411fca
- SHA512 3ba737c5dda6b649414a7fde0ee33bca82e081f13e6a33bfcb4d980840624994ea6b570b8e10fcae2923d1efd78167ac1ba94d627a14a900bbfd89c78ddea5ef
- SSDEEP 24576:JtsvYFGelhY3dUt0nj+6Ea5gbAft/hXYfatI5kVzN3zzTBJwKwvfFmUPIQZS4rAU:WelhbXxa5gm86zNDwnmBn9SLbr7LbN
- TLSH
  T13E859E00F68345F5D5821130216EA73BAA38DA25272499EFD3D47D789D353E22E3B37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  xpdf-tools-win-4.06/bin32/pdftops.exe
- Size 1.9MB
- SHA256 7c51bd4e6570259d3850dd40afe4e48fb4e9ca9955a4a33159d484196d9a71c1
- MD5 9ee2afc6ab730e224245cfdf9a14904f
- SHA1 9e932166f14494b1abc154e13abca73f89c3ca21
- SHA512 c0eb4449d5af422bcf3435beff821ee167aae52311bc7e03c45930501ff0c7791e60bd10c91b13d55ae7c4677ea169b886beb50d73b51210612bf18aee024150
- SSDEEP 49152:qB9kkiKuCBg85sIZW4ovS2v0bZBOOjsKAQgwAQW:WunIZ52Eq
- TLSH
  T131959E01E65341B2D5911170313FA72BAA38EA15072859EFE3A47E789D353D22F3B27B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  xpdf-tools-win-4.06/bin32/pdftotext.exe
- Size 1.1MB
- SHA256 100f65aa89421a3d778dfbd08c7bbd7eca176c6b285be297fbd333af3dcec5df
- MD5 fcfd82a5b26cacbd89c425331257f608
- SHA1 0371cbb2d345a66b3f68e724e4cb76b088c0d3f2
- SHA512 f661fa07a7605a61947ef11971d1cbbf8d2d045330e9b5cdd153ad8eee45481ae8f63ddf15ab9f65f9ea73094bd120cd0943cec13860420ef0962dcce7c44a70
- SSDEEP 24576:jDrofvb/XFad2QY8TzJEeovboAOM8ktUPInokEXrlE0kUEN:I/X6JEeovboytB72lE0kUEN
- TLSH
  T160357C10F58324B7D0510130216EA727A639EA190B2959EFA7E47E7C5D3A3D12F3B27B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  xpdf-tools-win-4.06/bin64/pdfdetach.exe
- Size 1.2MB
- SHA256 28e9bf42dbbc982c6a90f4e6e474076c5fbbe63b212709bd49bec1f4943430cf
- MD5 c2ce776f931a9decee6f710aa5609e0f
- SHA1 4dca59726ba6b2505fc5a60fcd404d2c3ec8e9a5
- SHA512 18feb421d78e406cfac840a70d36c8cf231f973cacb8a6dc453cabecac39f2e2eb8e46f61b2cb2217c28c14f3ac046f4e97053c5341ba456983d9ec5dc3cbd2f
- SSDEEP 24576:NXJkp0BK8hR5mTN8PP3qpbshwEPoQ4fse:NdBxR5mTN8PNwBhk
- TLSH
  T134556B09EE6B05EBC016C5398476B606F770B84A4B214BEF56A5667D6F333E11E3A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  xpdf-tools-win-4.06/bin64/pdffonts.exe
- Size 1.2MB
- SHA256 c877798654a38cf7ea14fbf17e46ae619d1bf6c5371f83653dec3578ee7681c2
- MD5 7597f5783d53a7e796a20ced496bb8e9
- SHA1 1825f91a08088b78cdf1e1a4c0c30eaeba12fc0a
- SHA512 7b9afdfb8f31dc8874f23f0f6eecc71fb5c72a182ef79eda80956d70f35a03cebdb05cb47b7a659accc4f5a43df7820b0823386e5f6a5a67d65e31c9003b248b
- SSDEEP 12288:X6EyLNLNDzBmrJsB2ibJwKq4zMqbmXj/VX/OT1o7C9K1DSAZvwsEPQpToVPv+M2:XD02iiKqPJXj/VXwKm92SA6sEPoTqP2
- TLSH
  T157555B09EEBB05D7C016C1398575B606F771B84A0B214BDF56A6A67E6F333E10E3A630
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  xpdf-tools-win-4.06/bin64/pdfimages.exe
- Size 1.3MB
- SHA256 1de0c1da7b606a73b39fcb1a5f55c1ab07553e21fc5e208273091951cd99571a
- MD5 9f3938abaa3ddf8a7604437ecb3dd15f
- SHA1 9c2da3394f88d9e2b6e4087e70a44f8bcafacf19
- SHA512 a19730f799e35293a0ece85c27cb4c2dc1fd36f044f976b83441e4a2def5439b550b200769b7b91cdda9e205f197c60961ec5ecd4405856b40bf5ffba2818a63
- SSDEEP 24576:iXe7J+om9jq6ynv2HzNa7P72qEPoIpFTi:iXe7y9jtynv2Hz3qB8I
- TLSH
  T13655490DE6AF44E7C116857984658606F770F41A4B204AEF5AA3BA796F337F11E3A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  xpdf-tools-win-4.06/bin64/pdfinfo.exe
- Size 1.3MB
- SHA256 d62f74198bd0d70561ee96bb89df1bc456954340566df61b5ca4ac547f363eb5
- MD5 5566d362caa76b811049817a38953947
- SHA1 f1fd3f5570ce3fa6c612ecb2def983be769e18a7
- SHA512 790cb7ad53b48dee72cb29c5269d9ac456ae01dff25c5d856f10242ceb84ce58abef2844f8cb8d1fdb29db56cd0fca149305eea2e53032ce9beb64655f5ef02c
- SSDEEP 12288:T3NlN3aBmrZoBjt0Lv1u2ajHtjHKPQoDbwC5096VJ3o2SQ68unEPQpyoaTEer7:PWjtS8FNKPQoDb7096JSQ6nEPoy5Tn
- TLSH
  T1FC555B09FEAB05D7D01681358576B606F771F85A0B204BDF1AA6A67D6F332E11E3A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  xpdf-tools-win-4.06/bin64/pdftohtml.exe
- Size 2.3MB
- SHA256 bd33ba7f33f1fa290dc1ec9d1d96715233c6d22eed58402a3c51dd2e04155b57
- MD5 0bdeb06c2c83af0081d09fae2530285d
- SHA1 40f3f84550bcf0b02995185622f7927621ffe4d5
- SHA512 c9293b312aae04352ba68d346af6889b9317a8787a9d6b8e96da9668de1cf2faa862ba8c09926d9fbd5e28e5883a7effa7a17001dd9e52f02e18922a38efece1
- SSDEEP 49152:4VMIA1Eeq0MJAjOIc+DA5cvIOoC+zkNDLTEyrqy:YX6A9QNJ
- TLSH
  T1EAB58E42E6B705E9C126C1388566B307E771B40A17205BEF16A45AF92F23BE11E7F339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  xpdf-tools-win-4.06/bin64/pdftopng.exe
- Size 2.2MB
- SHA256 2b6edbf26c6082bad085d275169c31f1959cb20644a37b7362824f4ef9f0bf9b
- MD5 759857128403d339be60acf1b6d35753
- SHA1 a27d3c35ec2ad7d114bc67fb4712aac77c3a0d55
- SHA512 f532a2f26b6b03dbc759b76e04a4d84d50fd7c34fe19a6cae4dcad21dfa0d22ab17aeb206dc6cbd94798e1fb9775e78dea0a554d2ccf9d18f27ff04d75ac89ed
- SSDEEP 49152:5DbChQjbPig+HsJPCiAu27XlOin2Vpk12MBhvwKvl:5M0au29UM34Kd
- TLSH
  T10DB58D42E2A701E9C166C1398166A607E77CB40917505BEF16A4AEF97F23BE11E3F334
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32