745b84223b450fd185279bd8dab4f71ff149bb832ec147449313dfe7bca55e4c

Sharing

Copy URL Twitter E-mail

General

Target
Whatsapp_image_20260721.pdf.img
Size 8.2MB
Sample260722-jjhsfscc44
SHA256 745b84223b450fd185279bd8dab4f71ff149bb832ec147449313dfe7bca55e4c
MD5 22a57beeee5f4fe89de15d3d75c69ff6
SHA1 6f74310d2a30f63980feaa34e6748e2e134fc5db
SHA512 3766313a1cd87b28577143c3071227a3c74a916b7e89eb874de9867a88bba882c276036840999213cb46e0d51291389f698ab2ba3ad4b8e1b2892b5a1ad46f5f
SSDEEP 98304:u6zCF3JnVFVVhxjjkh2PBap/8lu5dZDs:lzOVbTTPBk8CdR
TLSH
T108968C1AFBA801E5D077D138C5928636F6B27896473197CB12A9D72A2F33BD05E3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery

Malware Config

Targets

- Target
  1_Whatsapp_image_20260721_003.pdf.exe
- Size 561KB
- SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
- MD5 457142f0e24c04ac21fc367182c9e5a4
- SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
- SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
- SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
- TLSH
  T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  2_Whatsapp_image_20260721_002.pdf.exe
- Size 561KB
- SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
- MD5 457142f0e24c04ac21fc367182c9e5a4
- SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
- SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
- SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
- TLSH
  T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  3_Whatsapp_image_20260721_001.pdf.exe
- Size 561KB
- SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
- MD5 457142f0e24c04ac21fc367182c9e5a4
- SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
- SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
- SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
- TLSH
  T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  SspiCli.dll
- Size 300KB
- SHA256 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
- MD5 5368a0eda501b5bd821bb55664d04f6f
- SHA1 b43e4c935b2ecda48a88ff79868a41610f029cf4
- SHA512 df26d13641892e5ac17951fcca3c4b9a85dd3974622907e32a08c03251fbdf21fdfcdf16a4d6f0b012dc226791a50d8087b52bda9a284fe3a797bb6a11cb0c86
- SSDEEP 3072:uksV22GHg8RMkkKht2MST0SwDiANhsXmB/0WHZOVYOPaq0CQlmz3G7d:ukseHHRMkOMST0SwDiANmX+tZ/ZmY
- TLSH
  T1C564291EF6A548A9DC7AC23DC5478226A7F2B9601352C7CF06508639EE1B7DA2F35F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  WTSAPI32.dll
- Size 174KB
- SHA256 19d35e25e3ce431b7ca6b25cb60f19dff9ffbede098bc7762baadf4f6220974b
- MD5 62a5d03fddd89c185393ce55152de8d8
- SHA1 3c663e4e766475097ad0f64f64ec72fb942695f3
- SHA512 08feed176fa20e0355c1e4b04c20aed75fb49372bbba2c3b1199406e016ad21c0a4bdcebfe116555acb11edfb9093c818ff958a9ae819b8b84ff1dff55185858
- SSDEEP 3072:18ldGBK2dtlY4uJ+XKUNZIlG4FWvhxDMeWmQBxkfbn+Ro1ql8OCq9s6dez7:1skBK2dPY4uJBUNG3+xo/cbn+Ro4rqwc
- TLSH
  T1BF044A6E36A900EAE57A9138C562861AFBB37031232117DF0290C17D5F17BE87D3DB96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  atom.dll
- Size 2.7MB
- SHA256 0a3b1d6ec59becdc48c2f5096a85bbf49334d3011370de5aaf926e1eb4e7b5f9
- MD5 189483a8b9dfa1637de045aad18c9137
- SHA1 d15950fb4152b09e00d97320430b64372f2cae2b
- SHA512 4cb05a2879be29f9922ba43f507b8fa1864cb7cec99eff40448b8b0b697aa24195501cc2f9f1ce15398c7cf311bf5467ce14b994b971e031bcd30513f3f8f06f
- SSDEEP 49152:R1oHJQxmJ8x5r4FDqiHqgDnsPMFVM3WCaqujNa1qq4aSk:RCF3JnVFVVhxjjk
- TLSH
  T145D5CF25E3DA01A8E567DB78CB529332D6B178561731E58F0688D7162F33EE09B3B312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral10 behavioral9
- Target
  encoding-conversion.dll
- Size 23KB
- SHA256 685cce3972313dbba027be3d5770cf0c360d165f9d8335529e5bebecbd6dfe27
- MD5 e3c35dbbe9c3792b5e5d82f17ce288cf
- SHA1 7c205e7d955f7e67809e212dac1d305b75113cf0
- SHA512 c154e457dccaaf4e6a58c37892cf820f85a632a1dd08ed71a189b36614a66764a19642331b4ac3c91c61e9a01b229e4b8f082f78c03e805775b524cb2267eb03
- SSDEEP 384:VMe9zcdgoGFDJoloh6nYPLpFzDGG5mDFzDGd8JN77hhdxC:VwOoGFSW0EBDGG5mDBDG63hXxC
- TLSH
  T1DDB24B859F2418A2E997CAB0F0E6D61FAE30B78167A1D2DF427CC1611FC1BC232B915D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  root-service-provider.dll
- Size 850KB
- SHA256 f9651a6d5f970604ad5918734f3a41c06274cd0d392cffbad60fafb9def90452
- MD5 c68f1ff358d9687f07a24f2740704726
- SHA1 ae20ab4677a7e282b2bf96d7e6d644ee071e47de
- SHA512 261b164f38808817cd192ffd3dac24920fb98fb0f69de6641726bfe43b95233cf46750f7f5579ffbece95d4a8894d3b17e1089ca55ac627a0b03bb1bf1907451
- SSDEEP 12288:F0nkkxXfxAXg2GokubGCgqYWYDZxjRO5s1K6MlkfI:F0nJrAXg2BNblxNYDZxjR9s
- TLSH
  T18D05B61BBEB951E1C0BAC0399493653EF8B174A29B3157C75291971F1F23BE4AA3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral15 behavioral16
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops startup file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops startup file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops startup file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops startup file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21