2b46e1bdfa7bd31676e7ad81aa7a702e35c9685da9177489726627ae15c9cbd6

Sharing

Copy URL Twitter E-mail

General

Target
Unnamed Memory v06 - Death of the Nameless Story [Yen Press].epub
Size 13.9MB
Sample260705-xttjlaay7l
SHA256 2b46e1bdfa7bd31676e7ad81aa7a702e35c9685da9177489726627ae15c9cbd6
MD5 84469811b907ba6eaed5bc73866bf011
SHA1 48f48476ac18ec8d5aeef467b6a8624bd78d83be
SHA512 144e7a119e6bcbfe55cd5a1a2f77e2ba5ad2e60eaf69d892c9719b737b916f4922806feafa5aa682970ab6e3b354a480f81219167409a8e67de4ed8ccf2b9e7b
SSDEEP 393216:Dsie0e++BAh7i/K32Fi0vvzMm8aSkBcGAsdTHQLhzMeXOQOu0W1KdONelrGzn5RO:Dt+BPKGE0BKkb
TLSH
T17CE61267C9B06B27FAA1553C63192EEEE109453F03A1431C785EC94B731286EB1BF9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Unnamed Memory v06 - Death of the Nameless Story [Yen Press].epub
- Size 13.9MB
- SHA256 2b46e1bdfa7bd31676e7ad81aa7a702e35c9685da9177489726627ae15c9cbd6
- MD5 84469811b907ba6eaed5bc73866bf011
- SHA1 48f48476ac18ec8d5aeef467b6a8624bd78d83be
- SHA512 144e7a119e6bcbfe55cd5a1a2f77e2ba5ad2e60eaf69d892c9719b737b916f4922806feafa5aa682970ab6e3b354a480f81219167409a8e67de4ed8ccf2b9e7b
- SSDEEP 393216:Dsie0e++BAh7i/K32Fi0vvzMm8aSkBcGAsdTHQLhzMeXOQOu0W1KdONelrGzn5RO:Dt+BPKGE0BKkb
- TLSH
  T17CE61267C9B06B27FAA1553C63192EEEE109453F03A1431C785EC94B731286EB1BF9D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  OEBPS/Text/chapter004.xhtml
- Size 4KB
- SHA256 d42e270c7f8c5a36de68e08971d967aef65b2bdfea9bd4134827df0362630127
- MD5 aa1402c70f69919d90a921333711dab3
- SHA1 8ceb095f8a25aef70290d612a70b1e76ff8eaf90
- SHA512 247a02e2beae2dc4258fbe708dd39df7c46ef057eab9a481921744378b47432d392be86fbea16e8756f70a7a3a3013413c86f86802e7146c808545f9dde1aee9
- SSDEEP 96:oBrLRng/GBTln8WJ+Q/pjMKTHMDvOamaArNn2OOgbJ:ILRgeBTJUYyIsSYq1bV
- TLSH
  T1EB91BB2FD6592F7B15A1837AAE0D72ECB34385384337114078DFE127612286491BF9D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  OEBPS/Text/chapter005.xhtml
- Size 99KB
- SHA256 17ee608d651efba6ae9445065efed0c39b8f162c8f99f63b083515e8455f2593
- MD5 f6fdbc8ef68c1d9d21deb1812486b8a2
- SHA1 ea55e3e9392447e017db3fdfbf16b0ac937e0118
- SHA512 8678b1fa4efc7d265b4fed67a3e5c1720e51afacab6c31ae4ff36623ed5813c4a5432a75428d90351b43ccf77244419f0aa8eeac2e1bc4d8556b943b49532aa5
- SSDEEP 3072:I5RV2Pev60cHqZFUNE+axVIpVP0r3I7bQSJIQn5BQqQ:I5RIev6XHqZFUNE+UVIpVPxQpQn5BHQ
- TLSH
  T137A3B82BE788173B05D1837E650D26FEF707847D6323A660784FC12FA215429A67F9E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  OEBPS/Text/chapter006.xhtml
- Size 126KB
- SHA256 a92b578505a7b3bff421d1d1ca3ed15419cfae1fce5bb75f87cff80894aeefee
- MD5 4510a00410734be7f5a14b032cdb2997
- SHA1 2b09350dcca8105b84aafa55a36c3b4a58d9b6e3
- SHA512 f061bf2cdc188fc60f41941d67dd027af2ec58b0e4c688cc5474809463a8c791b398e00798fdc89e2e0b9bd104293253d003ec0c1066f6c4de35f550899429cc
- SSDEEP 3072:IesnVhZpMHhorVZ/LhnX4jeG5qCSYRFhnf+hlBCVN05Y/p2ixrwn:IesnDvMHhKZ/LhnePoCSYrgS/p2itwn
- TLSH
  T1B2C3C82BE754233B06E1837A610D66FEF717843D53336260789FC12BA125839967F9E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  OEBPS/Text/chapter007.xhtml
- Size 754B
- SHA256 42e86912910b863cd1a6cb00b71198e331e995575dbb27ff61335cb869ecd232
- MD5 e88ec750cef51dc3dc350345aed77367
- SHA1 1cf09d4bfbddfd9e2bc0344366e1e044b9d8a120
- SHA512 df6df7a56ad374d94b80ea60d6a733bab635cb0acec316cdbd6f6bfbb208d38e3bf001bc76267d710b9ed5467d5e3e88d11ae0e62917c9830030f094955d226a
- TLSH
  T12101D02DC46AAC13933255B8B595E295F083160482A11940B2F0B1B72BEBBD989C774C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  OEBPS/Text/chapter008.xhtml
- Size 27KB
- SHA256 e220882861a91512b7168c3a9cc8bca3cff17721486720c1a1598db9ba1bbb77
- MD5 2bad9a04be92d6c52a7da7c46d95d8d1
- SHA1 8364ccbb81a0b08ee44e151931e55148c74443e5
- SHA512 30012af4f427e0fd69e4f5eab6ab74e560b775bbf950cc3b91c8ea0643ac67f041be20f4e5d6ea9b820b3dac453f0bf1c04c4ccf7c47c4e106e28982d09fd04f
- SSDEEP 768:ILp38ShJvEKuJpPGXOVnV6YWLE4nen4RRQAP:It3EKuTV6Yon+4RRF
- TLSH
  T180D2B62BEA58272B05E1833E650D32EEF716443D53336661789F802FF225829A57FDE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  OEBPS/Text/chapter009.xhtml
- Size 56KB
- SHA256 1bdf8330bb115e2b85a3007d0a5af82e1c3c7b4c9b72ad62d5a064e32ae281e3
- MD5 571229680a9af459928f147c2e2405b6
- SHA1 a4853d8c4d6d32d6c75a846270c31f3d2a63da87
- SHA512 bc5dcfc88cb508d59bfd28b7abe4640ddee922aa9c473e5d93ba3b7785b48f7c80c080abce8d4299c5bd136fae2c875e18acf67cb177fe4fd513de54f3b20d14
- SSDEEP 1536:Ieu99kKBwjUDON17BB+iaBGgo4AUDnMuF:Ie0OKZDY1iiaBGgonoF
- TLSH
  T11943962BEB88273B05D2C37A650D26FDF71284785333A661785FC52BE116C29917F8E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  OEBPS/Text/chapter010.xhtml
- Size 11KB
- SHA256 85794861d53dc9f089c5a3816d1c3f07855386111be2e58e416e904e551c8891
- MD5 59e9765b37d0da597658c7c004529493
- SHA1 1df1537f19fb4e3f0198d3c99a9215210a0efbad
- SHA512 a6205530c9b1463c1ba247938d4deac899e0b92e6f1ac934bd9541c5c76a66ed427b6c8f812dfd74d20ecb0276830230c5cf1ade9a58283fd90ff6340847eae6
- SSDEEP 192:ILRKyJgpV5x5iWHgMeBqEDubchBxN75yueWZaeBwE+FRPhvM47xU0/nI:ILvgpV5XiWHgBBqXcZyUlBwEEPBMaU0A
- TLSH
  T10E32C92BEBD82B2711F2837E650E22FEF352803C53326511749FD42BE161869967F9D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  OEBPS/Text/chapter011.xhtml
- Size 754B
- SHA256 cc47f00cd6adab2686f9b34da1375e1a6c1b694930e7edfe209d24ead534cabe
- MD5 2787d1c79175d0977317087f735efaac
- SHA1 da0d67ce15148a385ae31033e3d60ab77ee362bc
- SHA512 a89cd25e036b7d081529c68ae3fbc104044c5cf3b4c110752fa75695890b0fb00811bfca0f5c296f8dedb981ac27cc886aa16bfeeb2c521a4e9b63d2eb372c40
- TLSH
  T1CE01D02DC06B5C13933255B8B595E295F083124582A11940F2F0B1B72BE7799C98734D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  OEBPS/Text/chapter012.xhtml
- Size 64KB
- SHA256 6d97e9ee29a380d5ad0bb6830ebcfa57037543afd7d7129f7c156a40bb09b13c
- MD5 7d8777ad358b33fadda550db52982014
- SHA1 79869f0f3606862111b8f868e29fb114c8c108c6
- SHA512 8400f2f2d644e3291e94abaf185838707693189832e851289543a572c3681896641b2670bd0915871b3088a5aa5d6745437ad6646401fb0692eea6590f12c33e
- SSDEEP 1536:IkSE7bnRRPKNtrU9Pm55Ssx2WYtIvq1zpjvWI:IkSCRP0xUhm5UsMPSvcpjOI
- TLSH
  T1FB53A52BE798273B15D1837D660D76EEF312843853336260389FC52BA116C29A67F9E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  OEBPS/Text/chapter013.xhtml
- Size 754B
- SHA256 d9eeefb6b78b3113daab60247e77eeecc39169be9d7d5390dd1667c0c0d333d7
- MD5 6bd1b786e1d28d9b0188015f93f220bc
- SHA1 67a79fe4edbdbc4a789b0064b838257f624c8b10
- SHA512 120dfa4f73e0f4825f82091982f735dde5430d5a568a6ebb6d9a2b51bb1550b7deefb37e76a170ad7d8d9ff8b72d028ab68fadb076d67d30ee161e5c90c19c4c
- TLSH
  T1B201D02DC06B5C1393336AB8B595F695F083124582A11940B2F0B1B72BE7799898734D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  OEBPS/Text/chapter014.xhtml
- Size 9KB
- SHA256 9489b75a72bcbb3eba754c4d1942055b9a4685f411fcaea9ab72e9304a8cccd7
- MD5 f67b50b48415c689cac75ecafaecbc93
- SHA1 9a6851910ff9ce651a89a1a2ee5b1c3412d2e09c
- SHA512 4f0d4966cfd5cc768ebcb68be02be89432fa007618b59792f695cd66778e338f148f76ebbb6843411245d9051798e2ba03192b9d9f772dd9ed1a9bead5e40511
- SSDEEP 192:ILRHyLCB8ymv+4RmkJ3rsIlQU9SrrjB+ORAWRxaQy7:ILJbB8C4hQUgrrZAW2T7
- TLSH
  T1D412652FDB942B2B15E1C37EA10C62EDF352843953327690744F852FB12AC29927FAD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  OEBPS/Text/chapter015.xhtml
- Size 3KB
- SHA256 f2fa9fa38ffe0dcb6fcb2748f881e005d5c0c7bc1dfb19954c65bf925c153e92
- MD5 6ca41c347d476b978f3d8580a4ef579f
- SHA1 8f6b8c12bef8d0bcb04d4a9211a5584cc4baa7fe
- SHA512 f7bfbee8e8142c661257b21512107e26fd03d39b61e596100fd928242c2bfcb38709d33ece40ad20ddcfd6545c9164da785d9f73d1334127dea6fc303e9d159a
- TLSH
  T17B61432ADE292E2B51A1D3BD92BE22D5F085406C922335907DFFC29B9363D34617F5C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  OEBPS/Text/chapter015a.xhtml
- Size 36KB
- SHA256 0c6f79ac6a6b5ba1bca09011a3ee5fde1962b509b8ad0104eb88f522ba9eb870
- MD5 5e64fcef0b4e27b157f5d74e54f5af50
- SHA1 6933fb40a43c86e9efb9216e542e51b9c46432ea
- SHA512 dd3b51cb7f45c77aee8db62883a1452622f1c6c469a31a0c7f81f4b5896df461d91e6a1f56a7097c4035c80973c08b0f21867222c67999d40a1081d5dc9009f2
- SSDEEP 768:ILVTvIZB/Fl9T4cSYgIT8XmHE772z1yhMk3tzd:IxjGtl9T4cvgI82c+wMytB
- TLSH
  T1A9F2A52BD798272B06D1837E750E36EEF71784391332A661784FC52FE122825927F9E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  OEBPS/Text/chapter016.xhtml
- Size 1KB
- SHA256 ce1ea3356eb1985ac3ef25962b7342f7fa6695b47c7a5ea62c7ff25e3feb1679
- MD5 9143ebb146b3f91da20a0d7a60c910c4
- SHA1 a6980036477a56a6425d463412bb7770699df6a0
- SHA512 b912afb256a82adf57e9ef217b4295bc18bddedb925bfa500987bdd2362faaef6de1a97b84ca253f6db70b62534e57507e8f9bfc3b8fc157c2f7ff5cdf5a37da
- TLSH
  T11331B7AFC8275D2B0133D3BEB51DA18DF2420005E150261079A6552BA3E76A8E1BF7C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  OEBPS/Text/chapter017.xhtml
- Size 5KB
- SHA256 f84654898cd4dd80e67d57e421651c93220005c62f2610bba45699d4f6df7e21
- MD5 5bace2a7ee07fa5bed040e8356d1ce27
- SHA1 7cc3bffdcd62ffb253a68d55f4c197994865a11c
- SHA512 281c34e9920b2b479cb1fb3194adbd8f5a672da8d5564a0a96ed6705a675addebbf234ebc22da59e4bfb83f54eda73c3a47edd0a07eb5512abdd581428f133a5
- SSDEEP 96:oBrLRn8k4u8WbC7klANU8/bVOMxFJcx8YqEkVARvlydD/NcGW00AvF:ILRJ2f7hUabgccOEkVPqGxF
- TLSH
  T167C1E82FD784162A18E1837E651E95EEF7128039032165A138AF813BA372D45B27F9DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32