5b951f18e49d0a3853fccf4c4427e118dc3ff918e27d50f1d8ba70e97650b2f7

Sharing

Copy URL Twitter E-mail

General

Target
PDF-XChange Pro 11.0.1 (x64).zip
Size 558.4MB
Sample260730-mx4tmagb59
SHA256 5b951f18e49d0a3853fccf4c4427e118dc3ff918e27d50f1d8ba70e97650b2f7
MD5 41f5fdd0f9c47629e1302980157816a3
SHA1 0c2ffe68061062b1b72140c9c058c47863810685
SHA512 097fa7f9626371373c6c8dcbcafde839bb0f85d02beac08e8029cd6256f91c1cd0f0e44d83469c9052682521a7e495eab09e8739c49e02c676c79213437cd707
SSDEEP 12582912:3dkN2TXdSx5OPBDg7fPTL50DbNqgwVHTbyMR:3dJjdSxUa7fPTeNpwV6MR
TLSH
T1A65933583DC278EBC64CA5FBC61706716610B5E07B2D512742B2E3F88A197F83737A98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PDF-XChange Pro 11.0.1 (x64).zip
- Size 558.4MB
- SHA256 5b951f18e49d0a3853fccf4c4427e118dc3ff918e27d50f1d8ba70e97650b2f7
- MD5 41f5fdd0f9c47629e1302980157816a3
- SHA1 0c2ffe68061062b1b72140c9c058c47863810685
- SHA512 097fa7f9626371373c6c8dcbcafde839bb0f85d02beac08e8029cd6256f91c1cd0f0e44d83469c9052682521a7e495eab09e8739c49e02c676c79213437cd707
- SSDEEP 12582912:3dkN2TXdSx5OPBDg7fPTL50DbNqgwVHTbyMR:3dJjdSxUa7fPTeNpwV6MR
- TLSH
  T1A65933583DC278EBC64CA5FBC61706716610B5E07B2D512742B2E3F88A197F83737A98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/enhanced/PXCEditorCore.x64.dll
- Size 70.3MB
- SHA256 e4ef950abd9c1f4bcce88999f88d79d77fe13b9f1ed8edb03a479a57369d6d68
- MD5 1640d42ccf911a3c16a53e6b19df813c
- SHA1 cadbfa8c8e0f2a6a91499a2b88fcff8044303fd4
- SHA512 d07291c2cfe5f7c94b5ec66a2de72d983f7f7f1716765c924b31931c3b44928f1d166b4281d193dc021ac938eb42a39a1d77af6e246c0b0f882984adfc2270df
- SSDEEP 393216:Be/emeSUFM2pq+Vxcv6k+VmkPWjlfeg8ekUZsSYdLCCq/m0FZT0mLJ+VcsPGZ8tE:1TEc9CvFfOc3OtfG9qjY
- TLSH
  T1AEF77C47B1B541D8D06AD0788A6BA917EBB13C46072096DF159069E67F23FF0AE7E330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/golden/PXCEditorCore.x64.dll
- Size 71.3MB
- SHA256 a095e9a0161652dd9285ba5f404a37c65a5fb2ff2751523cfa66ed00cce2e5b9
- MD5 0348d6f8f7fed18a916fea8e31d568cd
- SHA1 9cca3f15cb5b485a2a8dc2205ccf83f54a4d394f
- SHA512 4ee33e8ac4c52da3f5a26679f77cfdb914280acadf4f16e8ed42be17de895735857669bceea5dd93658b8f575a4df73638f512fab43aa184ca455a56f6db4458
- SSDEEP 393216:ee/emeSUFM2pq+Vxcv6k+VmkPWjlfeg8ekUZsSYdLCCq/m0FZT0mLJ+VcsPGZ8t1:MTEc9CvFfOc3OtfG9qjh
- TLSH
  T10BF77B47B1B541D8D06AD0788A6BAA17EBB13C46072096DF159059EA7F23FF06E7E330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaver.exe
- Size 42.1MB
- SHA256 21d074bed686c99b339204ffe9c687056df2c0f9ce750b809ff52408b4963d51
- MD5 63336177eb183fb2e0b5b8a9c7b97444
- SHA1 5ddab24333730871e9be2de2e91a926a699cfeea
- SHA512 668dfa1aabecef4bc34deb70678316dbdf3d71ca90a62ba21be877575b53f9f19ced95d6588be274553e21832e1e11b9b643b6eee5a485d22f7194367e26c6d6
- SSDEEP 393216:yeTe5eKeaYSgEHbYeZBwti1jcAAK/AOFawoWGToid:cQUFdcDEsPWGh
- TLSH
  T1B2A77C4AB1A514E9D06AD0748A96E913FBB07C18037056DF55A07AE63F37EE07A7E330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaverL.exe
- Size 41.9MB
- SHA256 4a4613a8eb8a1435d88306415fac3e221f3b20271749b3117f846bfe3caf0912
- MD5 9dc46f6ac10a4694f9ec7cf20800be49
- SHA1 264afcadcdbe172cb185801fec558143d4ff06a5
- SHA512 ed4b74a9f0acb613f96b5331da13807b260f19cab0d7ee75fce1beb9b0d0ee53c229c58a7fab9a4c370c27938c329abaa068c9740a73eb40623a32aad1870036
- SSDEEP 393216:otecebe1d7RbtD3GjMWBBmgUgTOUst/BxbzyT3UpNG07jXM1S0:kXWB+ZBMEpNGe0
- TLSH
  T1C4A77D4AB1A514D9E06AD0788A96E523FBB07C14037056DF55A07AE63F37FE03A7A370
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/x86/HtmlToPdf2App.x86.exe
- Size 37.0MB
- SHA256 9aae8645978c560927fcd3acdeb80498068a0994fce9ad963d6f3412a8726e58
- MD5 dffd852d89e7d146cf7c8e6690b37fd4
- SHA1 22368aaddcda9a4c02a24a49b30339c38581d4e3
- SHA512 896ede8df4167835faf422010f47cf2a05cae279fe88b1a3c174545775b08f70210a6ad4141f7fdbe854886fbda7c0061fa11177d85b3d2da1699f86e96588a3
- SSDEEP 393216:S7kZ6cETe0pXxhsLUxvdfLDXxxBn7xC54zENh7dG9kg4:S7XeihmUx1fRxuycldG9F4
- TLSH
  T14687BE80F68280F5C98A11B1943AF73FA7386F1547B489C7E2E43DF6AD326D23A35546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaver.exe
- Size 34.6MB
- SHA256 419f9904e2ebef12c4069894388e050505d60844a32fce6ae3e6c344d5cf7427
- MD5 42dc15e0186f5e034f85835066a54f8d
- SHA1 fdd17f32edca9052f032fb667274f90b176e65d3
- SHA512 ed9e8a1cacba07cd220cb72f0f5036afda5c8fd87e77043a4603a03cce0a75f8d5ca31f41f241c204898754b5e2b3f14554662af70bbdd65d6bac84e2b104eab
- SSDEEP 393216:Dv7U9cbVzA97Ta05eUg/HMTjJIuZxWzvAexKAGAoW:77FzY7+05E/sHSuALKAGA/
- TLSH
  T1AD87BE40F68380F6C98911B0943AF73FAB346F15476889D7E6E43DE678326D23B36946
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaverL.exe
- Size 34.4MB
- SHA256 b44b5b73b5ecdf55570351edcf6fa7b223b849db6472546ffdca99f0624ea49d
- MD5 aad2cf65d157b3b64bfc5fd38db70654
- SHA1 e7eae05b6268c1375e09066613fffda5e9d5b479
- SHA512 bef55380f694540f07e1aa5362a3d37aad41d4dab2f364839395fd92ef5b7c813a84aa32cc9f000d6191a69920aa33a11e9dacbca59d5a145db1111bc5104341
- SSDEEP 393216:dl7e3u2kMwbjmYzyGh+U9VlLFg1oJW2WSaZyc3MNvTGkQMyc:D7LMijryGUUNJvW7ncvTGkQMJ
- TLSH
  T11587BD80F68280F6C9891170952AF73FA7386F240B6888D7F7E43DE579326D23B39556
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
- Size 424.5MB
- SHA256 93e938b2a9a25216325a898ed87cf523e6718f8f3f5b6d56599314e6f6b1f47f
- MD5 6495124f824190a6b712abc48e104fee
- SHA1 7b004a1d298a819611b97571b7bbd597c78d0f76
- SHA512 2b9225d4d4d2595e09755fb5087b5d83b580dc4f328c763cbd6508587e470c5626d3757b4a5ab2fe6e498259b43062e07717236839b83bac54fb87cf824086d0
- SSDEEP 6291456:As0VPq3XGa8M6gntzgzOKvLV4J5UOsjts/2FqMpH2vkWNkXf8GtEqd8Ly2Lp+YuL:U+GMpgBB4ytwvjNEy5pLpLuFzlCOxy
- TLSH
  T13529333A3042C52AE2AD83B1855BDA789A70BC511334D6D716E4F2BC9F33BF8673A550
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware defense_evasion trojan
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral10 behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11