afe11cea6ec5a5a19ab508c2d0fe8c204b9f96dd2a9968bf14179cd5cec0cda3

General

Target
Adobe Photoshop 2026 v27.4.0.15 Full Version (Latest Update).zip
Size 183.7MB
Sample260728-26az8scd84
SHA256 afe11cea6ec5a5a19ab508c2d0fe8c204b9f96dd2a9968bf14179cd5cec0cda3
MD5 668bc1f0ef13e9a440b4f2a5d8495a70
SHA1 37583dc1ec88d70ca35b94b5a642562f28a4e9c4
SHA512 8f3a4b3b8b9f25de5e55014f1a519ce9604585a8675eb736af8921901aaa4d57426b8b571a8f8cf4526a0e6ebb1f1fc1a6861b9c40be98fe2a0ac27ac710a78c
SSDEEP 3145728:BjolDgfDfk6v1SUgAUVDJumaNNTKE819dzyxgY0fv2FQsFbrSr58st:BjopsfkgKAURE4E8Xdzk0fv2FhbrSdt
TLSH
T13C9833AE5D312AE3C924237A77520351FF705EB27B1283A52F70E82D2C3E5E81A54797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Adobe Photoshop 2026 v27.4.0.15 Full Version (Latest Update).zip
- Size 183.7MB
- SHA256 afe11cea6ec5a5a19ab508c2d0fe8c204b9f96dd2a9968bf14179cd5cec0cda3
- MD5 668bc1f0ef13e9a440b4f2a5d8495a70
- SHA1 37583dc1ec88d70ca35b94b5a642562f28a4e9c4
- SHA512 8f3a4b3b8b9f25de5e55014f1a519ce9604585a8675eb736af8921901aaa4d57426b8b571a8f8cf4526a0e6ebb1f1fc1a6861b9c40be98fe2a0ac27ac710a78c
- SSDEEP 3145728:BjolDgfDfk6v1SUgAUVDJumaNNTKE819dzyxgY0fv2FQsFbrSr58st:BjopsfkgKAURE4E8Xdzk0fv2FhbrSdt
- TLSH
  T13C9833AE5D312AE3C924237A77520351FF705EB27B1283A52F70E82D2C3E5E81A54797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

google execution persistence phishing ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  Adobe Photoshop 2026 v27.4.0.15 Full Version (Latest Update)/Adobe Photoshop 2026 v27.4.0.15 Full Version (Latest Update).msi
- Size 19.4MB
- SHA256 e34eb7d716211a2a67596558717dba076849fdc9a130caeb8bb733e8b1e2c2ea
- MD5 056ea21d93903cb1201658c522ae8c48
- SHA1 b2c6dc10591f47df419845d92fab3a16e13ed44e
- SHA512 bf23c3ae05ee5053eaec0b2615a073699d57f6722b13aad596e1a0dbf282de3d9957016a8560a9b0d59ffee45c4b41197beaae1bd4471f93da92e7b16cc9f3d2
- SSDEEP 393216:wHcqBrp4kS3glv+v87upy4GCAKUd2Cu3et1lG0z1MziYx:wZFpm06xA7dpIeEGYx
- TLSH
  T1011733A62C262E83CA5466BB23531702AF310DB33B1147112D39F96D1C7E1FA4B5D79B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2