b0397fb501ed32aae9319d75c3b9cb9043683955864e224ad7fd4b856c983e8f

Sharing

Copy URL Twitter E-mail

General

Target
PDFF_2822019XJTSQSFMXZT.zip
Size 2.2MB
Sample260727-plsnbsswcx
SHA256 b0397fb501ed32aae9319d75c3b9cb9043683955864e224ad7fd4b856c983e8f
MD5 7cbc7e687dd0b8c2dbcdbc34a5f70f9c
SHA1 4c1019c3d5c7f1028c21866c89517bb931a739e1
SHA512 be69a02d2571c75eec4cb53f8c1c6e05445f3a655b05c1fcbec78497a22e8ddc77bc7cb891c48a6648c07a36e5ebc1b013d5511504e9aae072be1364ed5b042b
SSDEEP 49152:ZmCp8P/tn8+fMVg6B0XvYjQWm/zZkEL8ERuraelhLXzJLNVXgB:a3JK/BFQWm/zZnL8yopzJLNZc
TLSH
T11FB533BE6B8DA5B8CE4045F7A9C164E1C82BD78308B741AF5E70DFCC186155AB8C0B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  PDF-Flip/PDF.pdf
- Size 539KB
- SHA256 b9fb00e36ebd53b53ee5126b613f109b97359a0b16a85aa4e6185b158c482190
- MD5 b9b26dd1616baf36c70e46af01947ad9
- SHA1 ae3776c719761a96ae77ba42077b10df2ee77c66
- SHA512 583791950132d6920027d06dc51a1fd92c21707040cf7b24180c2040edd739932bf903624c7c6105549712b1ecb7aff91b7efcc73974525164083c5614a35c30
- SSDEEP 12288:U3dZgKmMF8y3dZgKmMF8c+3dZgKmMF8f3dZgKmMF8FK:SDcMFXDcMFJADcMFgDcMFyK
- TLSH
  T135C4A66EEED7EAD4C3072E0D966CBC5A2E0281D95BC05F22698D7E54128D373E31B271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  PDF-Flip/index.html
- Size 648B
- SHA256 acf02ff0317a8b55378c42f5648b2b4460af6d09af9e155a030b158c4236f58a
- MD5 51f4d2e49b88c4f1e857cf6f0a1ce803
- SHA1 fbb7565850239efe08345ddac299564a71209215
- SHA512 addbbe86572b2abaef620ae733bf657f29e5248a6549cb36f6fb77610fe92e831f6c8905a61effac78c8a2015efc43530a7c736a9a1b04b3b09bd49cd03d4500
- TLSH
  T1B6F0FE065D06CC19912029A4E4E1F4588049F550D7C1DE9DD0D8566F7595BCCDD8758C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  PDF-Flip/pflip/fonts/GothamRounded-Bold.svg
- Size 219KB
- SHA256 0a66114f3881c879659ba0201fbfb92e02445789ff04da029d43a70da1735412
- MD5 7081c98c57c1297d4a65ce279c4b154e
- SHA1 2e57664f47bba660ed5d2f983d05bddcd4d2f4f8
- SHA512 780b21aab6fa7a79ce128a670a283fa824758742f75da1942dabe925e0bdb5236b6a219a9580a83646d99efe6fcdbb91312390f1e4b1fea0ecb7f19ccf2b2b5e
- SSDEEP 3072:3i6WAtB1gGd+mozpFbLtW2OFsWgA3cOboBx/38IHRg:gAHd
- TLSH
  T1B924646CDEAACFB8C6DE417A11254E70621DC1CF26397918E95CBBB12E0252D0FDE6C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  PDF-Flip/pflip/fonts/GothamRounded-Medium.svg
- Size 224KB
- SHA256 2c382e78ec0441b675cc07219f5813feb25e5e0d06407d129467011a96c46c96
- MD5 f08f34927974b84693b53cbaf0567911
- SHA1 58697371ae431041c5084e192abefaf2af320451
- SHA512 abe4419dfb9dbf8efbd6bf012d3c56f0677cb0dbf59d5a3177bf25649918eedc477d31fc3f6a0dd9818673cd2ba3a6968bae4f807f4d9f961eab17eb981ae4ed
- SSDEEP 3072:oivcoe9EqImGbuy1S4tP8I6fnobNU7Z06EIOvpfwfkZ:YEo0
- TLSH
  T15124527CD9AECFB8C7CE427A55124E74626DD08F27253908E85DABB05D012394FEEAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  PDF-Flip/pflip/fonts/fontawesome-webfont.svg
- Size 378KB
- SHA256 c91c455b6774821a14d8e47b8fe572eedfefc77e8b665c9c326b8b01d72c8675
- MD5 df5dd05c6445ca5433ef0ddbc5fec49e
- SHA1 a5571a71003a42d31c5e87c2ea5e4f49f586963e
- SHA512 a29b883150fb319d15c912d075998aace1809e90c0fe89786b8ab937329c3dc831759b3730103c1551f00da52d204b71612042ea9e58976a40739c34ea8e2590
- SSDEEP 3072:3G1+74+PC8RzArVKQqSpuOGSQd6oUtKpOm3arpFs2EzQQRwRSFRxOgB9WH4qjvlA:dITWH6yFR
- TLSH
  T1A784A76CF9500BB9C7DC42D0997E0D94532D926E18753E68067EE8F05D0AB2E4ECFE89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  PDF-Flip/pflip/fonts/themify.svg
- Size 229KB
- SHA256 2e2421027bbae2dddf9dd7f0374ad7eb9c3d75fbfa12eb64d32100d377eecf8c
- MD5 cba68f986e60df8c74f4a53c3e39595c
- SHA1 106a9ed6d6b0936376b5723611a602a2e3da66c6
- SHA512 83e4b18cddb0f19a6bd561f09894b2c49be38d609c6f5425e00e70f4329270a204c6b1815ba24c2e0de1d0280a392737607030fc5d7ae828e3e7b903c3ceedab
- SSDEEP 1536:jCJlVpzbspIrC3YWChhjzE79fX/4rxNFr8rD199MRUddhrW0XglKQfN3r3hS3z+D:QzhGfpOQkds+VF07Je
- TLSH
  T1323482C8EFA312F4ADCD43FEE7374CDD296D0CA6B4628DA4C66C7F56849381C490A895
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-check.svg
- Size 415B
- SHA256 9a680f1212888ede7dcae6bfc8cafc447babf4ce531271c8d07277b0aedade96
- MD5 1aac80711a19e2e435ef13aba855901f
- SHA1 015d03ffa6a0ce93b41ed93a262879e4f8cf72fd
- SHA512 7442036525e2d5c0ca86c3e6e343bf79f39c9d39ea4815bcbea3056f157465821fa19ef559c7079ea60c7cf99ab4a01ad47af7f46e02f8ff2822893b947b14a9
- TLSH
  T10FE0AB2DC388021190E947109A64F1041AEB30D3CB450909B4D4D9B2AF681C6A2995CF
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-comment.svg
- Size 883B
- SHA256 c58b385b4a0be6de822a3262b8191073d1730f6420368bd9c6d80db7312327ff
- MD5 4f3d3d9b61d113ba0d284481d2454af4
- SHA1 5ec875153d5046507050a3531422ca69b44680c7
- SHA512 3b0e0c6fa42084f28edabbaabca1052afd76c3c41576f23ebee598960da96556ab088e8730206d816c6d1434bcb03b0ba36d50abce074dad00cbce99fdff841e
- TLSH
  T18711C010C31861B6C04D0B50E67CF504933B7A8BFEA212A7B9C86B375B1E1E266A51CD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-help.svg
- Size 2KB
- SHA256 74d9bba0814d12f5ae2715189e1747b7edf5ff6d82c4ca75bae86d717319b6eb
- MD5 6ec1ca7b8aa80a3e10325e74d7998894
- SHA1 2f3d88f4e8cefafc2d76932104f6b2517034af2f
- SHA512 735e99c561fe8a509bb5375f77cff79c601f9fe82c3af9254a657bc2b6274a77ccde0014855ba1e925ea2beb207e0b0c6b138f3f78f41a7e9df71f5e58f2c8c4
- TLSH
  T1ED4181E8C39680A5D09F0475C9687804150B76D33B02251B77CEAB3AEF3D1A199E8A9B
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-insert.svg
- Size 408B
- SHA256 b2153e2c88c62179029ea9876d463216529ecf581b77d52c971a2cdf3d3166c6
- MD5 790992abfc5034ed777d4ca8b4865a96
- SHA1 7a12af74ef20d5249a0c330d992bd1132308cbac
- SHA512 f8caef572ed87fb5dd3c421665cdd1f5e4f414a65148d3d9990bbec21d9adad86810c58610c800b7649f719d88a53fc924f0dda88b1cb7883e74b709774061c6
- TLSH
  T1E7E0F100D30414B58028C7519634F40D032F74F37BE01F8768D45632AF4E2C3A0971DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-key.svg
- Size 1KB
- SHA256 5772b8dd158b0f02bb2be689bb680f4903d84e202cb29a3dc0560af53134c6ba
- MD5 40015bde172203a4ffa880a238d6d779
- SHA1 d9224d3aef774d6ecc9735b440810ada4384be11
- SHA512 e9e8b365bd41ae612560f438c6aeb0d1aa2e55f223812b26bf6cabf44b39bf2e1a42b41980fe60187199cea0f2adf1f31c7a0860be10edbc595832542bb1d7e5
- TLSH
  T1BF319954D37847F0E1BD95844CB2AD0D672734F17F41104C8AD66E11DEFD9837899D09
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-newparagraph.svg
- Size 426B
- SHA256 a583cca122263d94c3eebfefe83c965a1b305b9c84e5aa3c5ba10527941db7db
- MD5 bb7062f13b8ce19185fc37ff7dc67566
- SHA1 453ba47aa10b6fcf8459569e0a550b4f91260ec7
- SHA512 ae5816a3ba95cbff2bdf876f4f2f4a0bd7e347bdbaacc09a2e65d46d0edc256c7f0b896536ee5470a2d17cd903d3bae52bd506c12d77504ac0aefb25265eebb9
- TLSH
  T13BE0AB10D35818B1902D8292B775F008436B38E36AD42686B8EDA232AF8E0C321D72DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-noicon.svg
- Size 158B
- SHA256 76399e70d311834d11ab2d6239118b36847d79a78d7655b1f839d51c811304cf
- MD5 6508f26ea254277f5c0df4ea5ab9f24d
- SHA1 5a5447e5c39cf7ca748853a15dbd835ddaa3b5df
- SHA512 b74f7a79dc719acab1f351ac70f00455654dda140d2bc24eac6d48c804bf24ef5938c7d85073004e20b0b3c52f1c38f598f811e068e5b9092e11085d468af0ed
- TLSH
  T1B9C08CB4C2589E60806C8B100AB8D60817EAB442C082094DFDE02AA04E3858266C969D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-note.svg
- Size 1KB
- SHA256 11a75c9f233dd3e5e3500edcdd733358394f28395337616e8b0430694bf0dba1
- MD5 832e3217eb765543d201f3b40005956d
- SHA1 6100deeb6121f98c7e024ec1a273171207c84c7f
- SHA512 566be95c1dda2d5a52ffe0a6899f5058c547f91fcdc60dbe26a79b39fe427a79802d6d52eacb711acfee368318f7b0d54dc9067d88962306d4b0d4ed65d651e4
- TLSH
  T15B117815E288C5C4C20F45A6FE81B100012BB1975FD64F7A3BDC5276AF061D366E93CE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  PDF-Flip/pflip/images/pdfjs/annotation-paragraph.svg
- Size 1KB
- SHA256 efbcd2a6cfb4581dad74a1c09ad43cf2b8245611e5b19c966317da948f2bcb7c
- MD5 da51c08160d09ff8f5e8e09dc9e042eb
- SHA1 70591a3b26c56815c6e5ab2bae959e8a951c43fb
- SHA512 f016ff103e8de8e6cf19aee5e7b627ccce075844e41395cfa20342a0b42a13dce82106e4b06bbb1d7e7c135b0dfb8fba0ab3b0703f40afb9625048076ea3558e
- TLSH
  T1D8214421C34488A5D0AE06B0ADCDBA08111A58977B93165BB5CA09319FD71E337C57DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  PDF-Flip/pflip/js/libs/compatibility.js
- Size 18KB
- SHA256 a2518d1184971d090783973f7a2a7249bf03632ef5c0f4ebe79cb8531e7147d9
- MD5 7a56fd03f7fa3ebc3d2970b684044ee9
- SHA1 bfc682b6385a08316af7350d04f149c66f542c89
- SHA512 d89ae03fb91ac9a8bde7fb8d3030dd67c638dc6bf3377cc3f3ae556ed23844e0d750c55b15015146006461e70bc70b89870d66e3c4cd50a19823ec52e6eb9d5b
- SSDEEP 384:ivP51hvi2bXDSSo9rz+LKl7nt+3KppXSN0Wj2mc460slcQ:iDpnXUnJl03KppXICmcd0slcQ
- TLSH
  T10A92640D7EF231764563B0B95B1F6405BB34C4371018EEA0B69C87A46F6143982EBFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32