6e26f8dc9df22ce8c748525189f4064e6f126c3ca96d3a5f7fe12a39013584eb

Sharing

Copy URL Twitter E-mail

General

Target
presentation.zip
Size 6.9MB
Sample260723-pm36fsba39
SHA256 6e26f8dc9df22ce8c748525189f4064e6f126c3ca96d3a5f7fe12a39013584eb
MD5 8b15eef8588484d320151aecd791db5d
SHA1 e6577b7668d316b35157c25649fbe30f406afd51
SHA512 bd7d8c5e2fcc10f4c05d629b5629280f8d252cc262e2c673cf3a47f4f74a602128f526654aa50429fab2c98a8d2a0f17b35dd2a574f7d35d44a2cde916ddb525
SSDEEP 196608:5fpFgjtbHd0/d374BCLFZezima0j7WF/xxfQ/g/gnV:Fkj9H0dL+CLNhq7WF/x9Q/g/iV
TLSH
T1467633B3BE5D0405CE2BD4B65EBF4C2AF6F6539981E0650A3124C6AF86F6049371F782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  presentation/citrus-limon.html
- Size 2KB
- SHA256 28b8da380c41b050030f8c511278d973ea0b50a8a46e332f752a50fa67006e31
- MD5 968a80082ef821cb51259964a0a351b2
- SHA1 706418b7b772e6ecf562489a8474859e086fe97f
- SHA512 7f0855d2f2f547fd78fbef40a9afba926138fbecd0ee29abb3ff384027659f7bf09a25aaab241ce6c5ab81d0a4073f0a74e9a5dad5b004a5277c0c51b902e386
- TLSH
  T17751225AA844A12B42151AACE531391ADF76DE0BB257EC10F5FD0A370FB37C9CC1B650
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  presentation/js/bootstrap.min.js
- Size 49KB
- SHA256 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
- MD5 67176c242e1bdc20603c878dee836df3
- SHA1 27a71b00383d61ef3c489326b3564d698fc1227c
- SHA512 9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a
- SSDEEP 768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
- TLSH
  T13533B649725078B201DF9176913F460BB736788EA907816CB95D98ED2E7CD89322BF3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  presentation/js/custom.js
- Size 9KB
- SHA256 611a7a818a6840588ebe0872974d6837a48765d8841dd6510a51f3bb18309713
- MD5 685ddfb3405fdd2388af0790a77a758b
- SHA1 a6acff8b9498ad6d63160d688e8e3fd7b079bb4c
- SHA512 e524b59ed11a2e43e47e88f3357d34b5026fdecf5f6ff752018cc83b661e4bf5b32e3b0a03dfe31e2b729d5fcb7bffac4960aa5996223f3f0f92292344037e25
- SSDEEP 192:MblnaI5g1Kmp3KbWjlJupWxZ83zbRALQfqHeVc68ocvR5rQrg+51wOpXZqG2CJB:MbBaIe1f3FZ83zlT0e585jrQrw+5
- TLSH
  T19912EB81EF5C006A40BBF13A6AAE76CAEB5C04739D01B5BFF89D15146F8421F10ADF42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  presentation/js/isotope.min.js
- Size 34KB
- SHA256 f96151453bf5b861219fab32920589c930580c4f1c427f2e023e7429e7e9f482
- MD5 39258d5d7a1a2c1df44cb3a40e494e9a
- SHA1 a6a23845c95b5551c3ad8850365b5200331e46ab
- SHA512 54304e2250dbb82e155b1189366b85450d0b8b448a903a661b2ba1006e4b4c32ddfdd27f4b458c571ae247663e0b23cbe60ce3a4de1fffa8aa595049961b74b5
- SSDEEP 768:NMAyxzGdHc1zfA9ZVP4eAnmc6FumKSsCD6rD6G2UfdEhCDz2wK1Fxt:Mx6dOjARP4Nnmc6FuCsCD6rD6yVEQDzW
- TLSH
  T125F2D84F73403925468BF166926F160FB137E56C6A4690ACBA6AD8DB1C79C0D6033FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  presentation/js/isotope.pkgd.min.js
- Size 34KB
- SHA256 8418441b0715e94f110523b25c19dd94a5d31e82fae5f1c9742e880e2bcd8f3a
- MD5 8f61348c3f1f6c12dd5621f1c84ca062
- SHA1 cdb28a2bc4bf44e77dd18d71e83843ee4dda3c2c
- SHA512 0d707fc1854ae5f9a913e4f551d35424e126646af3094530b8c6375138e22290de456cfbc95f0745451a34fd7d566cd787a3c730e400e66f4b9a274da05fcd75
- SSDEEP 768:efyxzGdHc1zfA9ZVP4eAnmc6FumKSshD6cD6GLQfq9SvDz291Fxt:1x6dOjARP4Nnmc6FuCshD6cD6xS9ODzW
- TLSH
  T14EF2D74F73403924468BF166966F160FB137A56C6A4790ACBA6AD8DB1C79C0D6033FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  presentation/js/jquery-3.3.1.min.js
- Size 84KB
- SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
- MD5 a09e13ee94d51c524b7e2a728c7d4039
- SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
- SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
- SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
- TLSH
  T1748319DD72C6B06247AB71BA00BF550BF2361999684D4410F129E4EABC74B4E823BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  presentation/js/jquery-migrate-1.4.1.min.js
- Size 9KB
- SHA256 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
- MD5 7121994eec5320fbe6586463bf9651c2
- SHA1 90532aff6d4121954254cdf04994d834f7ec169b
- SHA512 b74a2f03c64e883b9a34de43690429327dfb4aa230a7a6afca8150a16e3d84e98461245ff264c26368d9904562cc34fe219f71f951d364fa5c68c039b76776cd
- SSDEEP 192:kZrk/GNyd31svs7wkX8KzJcqSDdAcHX4YE5NLR:srhNyNO0kkMKzFSDdAcIYwLR
- TLSH
  T12E22C79DB29A70625FBA35F8617FC11B717A94FC2118D9E4A08C8ED1387DC9D403AB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  presentation/js/jquery.plugin.min.js
- Size 16KB
- SHA256 ca93b23e2343efe7c4b5b4d6ec6603ecbcf4d2b023962b989ad7ff6e450c9d9e
- MD5 9ad4c5bb153e885ca2c0c25119e41c45
- SHA1 6d63482b492ac8cdda3892d084cf99e035963fb5
- SHA512 0ca5c098a4ecd4a3718215a2e29226afacea7ebe90cdf6b7a91fb7b7c10febcd6a1ad77a8702237cfc6ad8654c7f53c1a5e1cdf453b237538312a7c8102d070f
- SSDEEP 384:koRBZlBfZQaBJ9D8m1HKpQTlZlq1SrU8ZecK:RF89KbK
- TLSH
  T19572A849617053829EA310BB513B620B347D9727A544693C7B2F82CB6F3859B933BFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  presentation/js/jquery.prettyPhoto.js
- Size 21KB
- SHA256 47ec7ea65620c8be7945819dd593916a9c7c892e727e645c2990819c414ff31c
- MD5 f81c3c778084503cad39095830c6b3f1
- SHA1 bc381d45657dbc8d47ed45dca67320f421966f04
- SHA512 0a9ffdf67ee4ed3b0b12136a2658114d07231c6271baaade93838e9b1661f7a628f43c54a5ca282245e86aa9bae03f888f1537bdd3795a36b10a9880ad3f125f
- SSDEEP 384:Bq8MTFam8FfdR+zubzguhP3l+CBb3+8rBEpiijfIj7lU+glBgLJbp40a19ATukrJ:e8Fgull+Cp3+gxq+2qyr1CakrO2ouXv
- TLSH
  T138A2B6285D20689F8293E362F407572DD1328E37DA16D470B278EC752AF4AC6653EBCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  presentation/js/owl.carousel.min.js
- Size 43KB
- SHA256 a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d
- MD5 f416f9031fef25ae25ba9756e3eb6978
- SHA1 e2a600e433df72b4cfde93d7880e3114917a3cbe
- SHA512 6cfb3b01eea956f84e4a221cc940a547bfead8e02c462a2fc38bc0917fb325bc374a101e7aa7b3ab9d11208708511abb39adb4ad6da7daaf9fc9704d714f65af
- SSDEEP 768:UCI7dmuMFAAJG4dlQKNORpnXGAtep2lcwJeL+wr2RSGc7UuHjRUQuFBt33:PITMFC4dbMVRSGcgRDV
- TLSH
  T1E7137346B3202D2A869B61A0663F160BB23A241CE414547D7D79E6DE6D7DC8C213FFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  presentation/js/popper.min.js
- Size 19KB
- SHA256 f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
- MD5 83fb8c4d9199dce0224da0206423106f
- SHA1 d8503645c17f9856868a7def3dc0505e19a95ec7
- SHA512 95d735b0fbb5159f2c9a0920a7e1f09d8c956f57919f6c0498aac383526a3c46f4dbe122e243730c843453087400954b4058c9a16c06fbbeb8c7bd33cb94efe0
- SSDEEP 384:fYn0vf4wzTC9nNbR1PTM4CrBEQxkxpOxvYLmD75zfC5vIfg3rzGp/TidOgHhXjE9:w0vAwzTC/nM4BxpOxv/D7pC5vfzy/TiE
- TLSH
  T18C92A3DC3294B06647AB91A7A07F960EB1335875610E9410F19DF2E97C30EF9613BC79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  presentation/js/slick.min.js
- Size 41KB
- SHA256 0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
- MD5 d5a61c749e44e47159af8a6579dda121
- SHA1 3b41b3bc956685015a347a2238e71db29dfa0dbb
- SHA512 5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e
- SSDEEP 768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH
- TLSH
  T1E513A549D205276285D721E62105C40EB3F7FB3CBA22C0E475C9D3EA646EC4896D7BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  presentation/webfonts/DroidSans-Bold-webfont-2.html
- Size 244B
- SHA256 ca8372befa4ac8ab6671dab1c68ab34b9a7f7a6c96f54515fc3a1bccd17a37ad
- MD5 dddcf55b613b5f25a3c7679481f86317
- SHA1 3f58022bffc74ab11feeb0e199a954ca0543def1
- SHA512 090cfa71d2058cd7c59c79283ce78d576588700b1119800cf9fda9430fc506cd31d12004ba7feffdaf044bdd75741b60f30bdcab4796b6accac6693fbe45720f
- TLSH
  T120D0A7DEE083639B801216D07BC216D265D85366F87541EC2C42B48E915977EC4DA6AD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  presentation/webfonts/DroidSans-Bold-webfont.html
- Size 245B
- SHA256 7ddcc9c213eb3d8135e3fbd4b627737cf26077ef8fd8eb13180a47436d982936
- MD5 1322fa49e84e48fb3c8006723075952e
- SHA1 05f2615dca71d62a1ea8ff775992f64dde6ec7f0
- SHA512 4c6e309db78a882ae85947d2401e3ce4537aad60dcad7354a8d49e5d01c14c7dbf788e4d079c0ab22f3c5022fdecabc12e182f0ba21a23d4bf1bd45b9945e1b2
- TLSH
  T1BFD097DEE083738B801316C07BC206C261C81372FC3501E82C42B08AC06867EC4CA69C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  presentation/webfonts/DroidSans-Bold-webfont.svg
- Size 141KB
- SHA256 8ffc424e2187b1cf8263154173b8cee4a1e764d0dda484466bed966adbf6b998
- MD5 677ba34477f36e04a8e7ab8b63a5d494
- SHA1 07a5f630786bdc9788f921440809ecfd851236ab
- SHA512 435691e166c13ea7027bd8ea905b421d325d4380813759094698efd73f1fcbdd6030949610306f4abda602c949067daf555444ee01513d4dafae60af79743170
- SSDEEP 1536:yYfwHTEATq/PEmsQ7wMMSerwxLFl7nuATY2dJCB1XlHrol3FYLU+j+rwe/j3G:Diu4cnrpdY71H85FKU+j+rwCj3G
- TLSH
  T140E33436FC8C8660D7DC51A8751689B0717D33AB2A643B112CAC73B8ED053668FA9DF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  presentation/webfonts/DroidSans-webfont.svg
- Size 139KB
- SHA256 624cac01b30a110aa1df9f70072538e54f3e902e74c77254b20e8f505fb6aafd
- MD5 489d660748c63085b07e9a8af032d559
- SHA1 514922723840e7b7f652118a126414da22f0a645
- SHA512 ce8cbbaf96eb67771334147f843e431586f51d9d1fd21b13be17b5850054faad28c444eb51e156f5ca2bcece837cfe9450e4a12dedcf3062040bd4e5a9972586
- SSDEEP 3072:jjHheK2KkqhJFdhyqcAzJ/0FddY71H85FKU+j+rwCj3G:jjHoXy+ddY71H85FKU+j+rwCj3G
- TLSH
  T1E6E3443BFCDC8660D7DD51A8B51649B0727833A72A613B111CBC67B8EC013668BA9DF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32