General
- Target 12dadccc337579815e4a1245a6a01931445e510c63388b7c90b87b865af42be9
- Size 102KB
- Sample260727-dszvfavdkh
- SHA256 12dadccc337579815e4a1245a6a01931445e510c63388b7c90b87b865af42be9
Score
8/10
Malware Config
Targets
-
- Target 26001803·pdf.js
- Size 204KB
- SHA256 099f3251e60fa5a1872240e3e2ae6be86848b4a1f6cd8671dfc4045cdf81e65f
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger