General
- Target OZMU# P6834·pdf.js
- Size 23KB
- Sample260709-kgetfsf16z
- SHA256 4672cfba22633af8f7ef8c69a05a39f8ab2018bcc6df1009c9cb0c643d33ed0f
Score
8/10
Malware Config
Targets
-
- Target OZMU# P6834·pdf.js
- Size 23KB
- SHA256 4672cfba22633af8f7ef8c69a05a39f8ab2018bcc6df1009c9cb0c643d33ed0f
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger