2ea33d145a43194aca5a1e6e886e4087ec325d325dd9440c687b28902837713f

Sharing

Copy URL Twitter E-mail

General

Target
VIT.zip
Size 18.1MB
Sample260705-pmwflscv5v
SHA256 2ea33d145a43194aca5a1e6e886e4087ec325d325dd9440c687b28902837713f
MD5 74cf54edecbc7962794352a2e7c0042e
SHA1 27ea870340db0154585ddcf73c8a3e3a50e93079
SHA512 d65defbd856f7863cfff99115cf761c73604fa2a6b969bcbf006221165d10dededcc4e4c36bac18e942424537b2b303d70cb23ae576c94c923680ec3377c350c
SSDEEP 393216:0RCcljAb5f2Og//uh5OsnJmkUqLBeunQcigxjcgTfha8Er/K2kDU7vaH:0rAdeLWhcsJ8qYuLdJFlqDK2kIs
TLSH
T14E17335571E79C22C47267774EDF3E8303F20081587396A37A897BD9ADAB2CA14A4D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VIT/main_file/10th certificate .pdf
- Size 1.4MB
- SHA256 9a90a32e9db504e9b1fb113bb68c945b48511f1291616a7e47fecb4980ff628b
- MD5 8ca8296dcfe644bb9a0d9359d1ba1f54
- SHA1 1ca510d06fa6cc0aed18beb658d1707f4a68045b
- SHA512 6f5a6dad14f79f014383f594ef0761e3940b115ce9d7083aa665cbcf98e3984d10e93d8936d9db3669d973991d70b64b7106a8e1e41d44cbe69003c7abfcdad5
- SSDEEP 24576:Gh11wIZnGXuCIyDRtdlSalB2eOpXS/sDmWA4CJV5G4L8V20o809JYfcnv2nNiQks:Gh11VGX31POpqsDLA42V5G4LR0o809JQ
- TLSH
  T1276533EA1DB75800C93699F7BAB0784C7A76B2EE9553794D10F007A77FA2F64620CC84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  VIT/main_file/12th_attested_marksheet.pdf
- Size 97KB
- SHA256 9b1510e7e6932aede488acccee6f5d1b9a89d5e3dd9fe25325e6d1b6421badc5
- MD5 4a45d6aad12ff36c87b68a2c3ce4860d
- SHA1 c9d1c8931b51135912acb4bd68a10122a63d0fb5
- SHA512 2b5926d780d0a675f5f3fb6c8b6dd43d426cc794de842e54e74dbeec575abb05f6b76bb805f164ce4d91ebc6524b2cd0b20bb9942f2df13b7b89b3efbdc0252c
- SSDEEP 3072:PaXtJ5FfLEheFsb8x0DZn8O1zSl1OG/r5rZdEQG:PaX5x44ibyWzigU5jO
- TLSH
  T13CA31232C3B388026D17406741D9FEDCB1E7F2A6C9646DE8B59D51A70D30EA9A3217D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  VIT/main_file/EmploymentLetter.pdf
- Size 115KB
- SHA256 4c46568ffe3fb00c02ebbfb88a8399b65b0a29e61e563c4ddc82079433c8e5a9
- MD5 53ea6735e9f25e6ffb7c96f1333cf761
- SHA1 b8dc0c468182cad083d3b9d17ce8fe28888a355f
- SHA512 397d8b4cd4d9b21de964d7e3e05ee34f074955553786b15a6622e75b949c0e3649490223a6f1e5dbdd6453f7c2e123cd28980c6a04f2095f3afa0d06545471f6
- SSDEEP 3072:IQ2254GxDbCD5k/XS3yJN5uR42VcXsS3AuEeIxt:R/bxiDS0sXycXsgAuLIxt
- TLSH
  T15BC302A37C4C2CDAD68427CD3E14790E99BDF35F6C81997410780FCF9AD8D425E2AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  VIT/main_file/PhysicalFitness_Certificate.pdf
- Size 82KB
- SHA256 a623c0aae0b6a99344a08ffeced7d4ac1e7743c188e4f0355a8283f13b7fceb1
- MD5 9e8259c7d4a9a92127b4b011595fdf84
- SHA1 bf7ee945c147c1bd717020f515f97da081831f96
- SHA512 f2ef6d9e00a8b5aeca40123e53291758c3f9a8a53f95f2beb51cdaf425945a87306325851eed2b806ea974623e897cbd74f740acec5d314261eaa93e135d63e5
- SSDEEP 1536:namYYa7JicjT/nUylljg5W+49Hx1jEfQ4:naJdJvHsyXjg5e9DjEF
- TLSH
  T17283F215EC048F8DCAA023426715784D4ACDF29779DC7A9332ACCB121752EDEDD66EC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  VIT/main_file/Student Profile.pdf
- Size 65KB
- SHA256 5beb5fdcc6e31076eb02ed7214277563c50eabe13632d8b0c765858b7718a596
- MD5 5f279b5d41baadd367f5ff06814ac2df
- SHA1 c6aa3f22cf344854d0450e2c8f9a31374e83497e
- SHA512 edfc18f97fa68e3f46d29d58953849d49e3a6729cfe4dc45058f8883dfc6f8f319a4b0d607b33b87f877806ad7c1b25aeb83a8f9cd6663b72173d6bd0ee2d9f1
- SSDEEP 1536:0Dki/DzMEjSCLAD9qZ3SWUSfaVeVyZH5nRagBeDr8JHZxx:0Y2NegAJ4QSbUjRagGr8Jd
- TLSH
  T16253E123CF658E61F5C097382EAAEB8E2366BC9E1AD275CB342E5D05F7145622DCC049
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  VIT/main_file/Undertaking-Form-2025.pdf
- Size 484KB
- SHA256 2d258abdf340d6a71e4ab7b32a9df4ee22d88057a6d9905bd34bcad2d822250e
- MD5 e28e3e302edfee1447df2a33363e582d
- SHA1 026ef2b562f28ae5417ef54f908505037ccc8864
- SHA512 9e689a00046ddf02e93359324e3abe9452a1530defbc56c1ceab360230a77916d9a9da8ae1cce6c30665e55b8ab0022f01f8ab659ae2d0cd7efd02e29885c382
- SSDEEP 12288:4sMKG/J2Pn4+rhnlQieAmwcKKSxoEXdVMwrECU:lMdR2QwVHF7tXPr1U
- TLSH
  T1A9B4F18E9CA7D5CCD8735B935FEBE08A611CBB0285D593D331BE478E2762C4068E7225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  VIT/main_file/character certificate .pdf
- Size 1.6MB
- SHA256 f0f32e4c562b3c44dca3504f931285cd1433b867d635ea810aaaca42f1ec602a
- MD5 785c81859fc3d2f93fdca81c9488776b
- SHA1 48099a8ef719f25263a553eda9ac4a4bc0c6d463
- SHA512 d670775f7e8db9c3b0081e3ae1e1d5edc1fa592a00354ce0e2a0bbffa059163b337906e3099bdae8f8cc5e9057e0d14e852691eab3a1069eb537817fcbce6a78
- SSDEEP 24576:rp3yZCAyUSGDwSRu8v8OmfKAVMCoMpW54yx8PsyrvC3/dj6PJF4iKU7d5mP0g0:VyrynGHEduCN0CE8PsyuvduPD1KyWx0
- TLSH
  T19E7533E059BFCEE2C1A45361E52E6783372EA01C19FB9023770C73B553A261D3EAD169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  VIT/main_file/edited_notary/Affidavit Student Copy.pdf
- Size 468KB
- SHA256 b610981330db104e29b727cdb735f50d831370ef36d72ab421157336dad00d82
- MD5 3d6c4e20f6d5333e496fcd93be2b74d7
- SHA1 1d733729282a893cf8355c1a42f3ce78d79f7f29
- SHA512 1a4018e160dcffc7a55b492f32ac6aaf87e63987566971b64bcd928d94c5707171ae06d23a320c89726f344d7b59baebf98a464f04d483e541da1ae666a53368
- SSDEEP 12288:HtBx+2OaMCpEP7e0cQm6lwfDB3VL5hS0h9kc2rr:HtBx+2OjtiC8jDS0Ur
- TLSH
  T10BA402540D946CECF8A2C622DB6974066F6DF21B94D791C1F88ECA674793F0AC2DF182
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  VIT/main_file/edited_notary/hostel affidivit Copy.pdf
- Size 153KB
- SHA256 438883af7b37030c229daa34e23031d4e513ce0a14f35aa60471ec6f41874c4e
- MD5 3b7b48c6e4da3a4dd4bd82f4bb48042f
- SHA1 e6c5c88370bbb5a1379b9c0e25dede1b13775e86
- SHA512 16350aaae4f9892612f49a74c8ab3ae163c35e9ca7bd9ef0bd0a8ea75cda4a3ad21a3f0d1fc9debe0e0fd011d7ffca06f2079ca6ff2125f35887d7ee78dc313e
- SSDEEP 3072:7lXsC0fQuWwlQUNpIdKBd3Yxa3S0Za3Tga3I1jD3xoH653t3n53t3lgSha:RXuQuWS/NzM
- TLSH
  T148E319488D9E88CCE9778B936BFAF082646CBB13D5C887A7302F474F4752E059997721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  VIT/main_file/edited_notary/parents affidavit Copy.pdf
- Size 470KB
- SHA256 24b60fc0c26de85b9fbce6c5fc190d843e2bc321826378930e09021700623fdc
- MD5 2e9f69f7e5f0da21732c738b2474393c
- SHA1 25f0d0635fae250f80c6dfbce9ca03bc05d0acdd
- SHA512 507b6fbbfebc6229bafa9607d6508cdaeb44664ea6319006f05d524cbf39319752cdd3b0ee778d0041d395fbdb047fc81d806d73c37e9e7e47604894032dfd67
- SSDEEP 6144:WVKhkxh06iGxUJH6Y4HqeL1ercgIZ+YIYqL+JmnVCl/SgvydIPhaQp6jJl/w:WVKhkxhdzNKeLYrNYC+Jakl/SgvtZaxw
- TLSH
  T182A401142D896CDCE8E5CB56EFB0B047AB6EB31395CA82D631AE82474342F4E85D7352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  VIT/main_file/edited_notary/pls no bullying Copy.pdf
- Size 492KB
- SHA256 4ac32f87b568dd45aee6ab459a19cf38384806184000aa067d5f465363fb8bc0
- MD5 b285a44b23ec8e01dddf3e5bba60bc08
- SHA1 edc01973e2302d7918ba0856c4bb0908791aacbe
- SHA512 c3b64d2ed6d3cd26c364f2ad2726ea2f84f18ee3bc85ec6cc42675046f25aaaf009befefea49e3b5e35edb133e5bdc3627c3f0decaee7da2dbed957d4f3d12e5
- SSDEEP 12288:I48Zzyl0e6QZaxTnSaUUtWV2X64dxQ9UiAD/Nbgk:KIb6QsQ456d6iADlbf
- TLSH
  T170B423954FCBCCCCC869C7325F2DF49B082E72E7985588B8715E5B0B0322E92896BF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  VIT/main_file/photo.jpg
- Size 206KB
- SHA256 b87524ceb5f54b09480b3f21638b997b4cbc356624ef5dbaf84e6f0303a8303a
- MD5 53ea1f7cd00e304a476756fe905d1c5b
- SHA1 7b9f3089c12073538db59818d9c674e78bcb00bf
- SHA512 61a9bc60e6d2450de1ab6891168297fad3057d1e8b39c6ee07a789dc664e105a0fc055717c88085c813b9d248af6b748c7007145b84fd20e5d35a1368a9b06f0
- SSDEEP 3072:t746A6D4CGGoUiaXMQpBgpSfrk+ZaR1ap+vceDCnTTHpWEoQgXmZNi2mW:ttAEoUBXMQWSQOp+vnDKlyXmEW
- TLSH
  T15A24F18C26D6E172CD890DF9AC38C7FBE06888785BA5FB5C209C1F614F6678984D8735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  VIT/main_file/provisional letter.pdf
- Size 398KB
- SHA256 004a681c478a111d974eadab04e61d7805c32af66d06f063bb485bcc6889e02f
- MD5 8d44c69a40deb0eaf8851f22b673437d
- SHA1 30aa6a5e0c97e592ec4b50caa884eb1c8ce874eb
- SHA512 d2637a2eb6fe632ee284d28781ec812ef3696e639691fa258e35cad092397c88f44d6f6ca3b30f0d97c32a88f53311b94f516217bd85ee07f30765b5c9e64390
- SSDEEP 12288:bUbOi9hfX8UutOrPOrbaw7aGrkS3uAGBh:bUC0RX8Uutymrbaw7oQuzj
- TLSH
  T129942333F942EFB6C54543C81A27BC21533B7A30669B35E6093B09AF7A9CC424DE619D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  VIT/main_file/safwan_passport.pdf
- Size 5.8MB
- SHA256 6fc0d50d23792068b3773523fc1a4fd6ae23155cfd65ccd394e73686a7bcbb60
- MD5 dcb1c118e48c4e1c89502837dae18226
- SHA1 e7da7279ff474e5c3a46540d78cd0fc67a1ebc4a
- SHA512 dd6e30111836d30ba12ea2d58aefcfe3a0ebfbeac02903c39e5f1ca0d0c0f1d9bfa3e732ea9d83c67a8975cf461f366377850563810e34bf8961d5e5f5da1875
- SSDEEP 98304:AmlXXshEWFzHqgpnT1BV9mbHWG23DgXw8b0JKkt9L7xso6A7omRJ8gGg:jAf5Bnmb2GiDgFIcO7xso/Z8gF
- TLSH
  T1E256C2078C089B47A52883E8BD030E6D6F5A7B1CE9D636FF01275EDB7D602215D9E06E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  VIT/main_file/shajeem_passport.pdf
- Size 119KB
- SHA256 5a71c8f33993e8ae12d2d6cd066a1fed02e6488920f12819affd2f02c1e67b79
- MD5 a6f0dc3b5607b095a153b0166cf9650c
- SHA1 9bbbf89756222b55d722a843fb949c587c31a6b0
- SHA512 edb65f06ceead7aa8b9a335d0a34f0e772c869f73bfc1527a84ef68e1e4733c872803beeadfd52885e7b1ebe29e0c10f74a661adb3f29bbef58685b18cc8fc43
- SSDEEP 3072:0+rcJBZ2LpcJXd57Yc8AeMxfCzynTGVMxnQCWMDWMOqiloM2:0+r62tcJXd5jDfmixnGQVOp2D
- TLSH
  T1D1C3029335193A99EF028AA5BF026209FEC7F28265CED0B1309EBF926345F614C5735D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  VIT/main_file/shajeetha_passport.pdf
- Size 84KB
- SHA256 f5fb0205386fb2d513470a8c98e08934a3b236900dca4d59e3e3d10fe5f7a742
- MD5 3a683582a9a5318fc45a38f89234801b
- SHA1 6037b40862ac17f174ee446dcf40a2f76c92d31c
- SHA512 dca69e72631d1b2780b2b11a883d675b08009268610adee4b90e418b707629626da48b22ed22e210ccd85069ebe27781a0013632096f675309471f688b75cfa4
- SSDEEP 1536:yCsyUvSqzq6Eubi06o/3SU+g/OVXxMcWhvUF3LWOC7LUfdy6Xd2PJ:kvVzDEubl68+VXxMc8UFLfC3cyR
- TLSH
  T19883F102E64669C1D1674DE57F183E5BF9AAF123B5C4A064B9BCCE07A724FF8081B245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32