Overview
overview
7Static
static
5PDF-XChang...4).zip
windows10-2004-x64
1PDF-XChang...4).zip
windows11-ltsc_2024-x64
1PDF-XChang...64.dll
windows10-2004-x64
7PDF-XChang...64.dll
windows10-2004-x64
7PDF-XChang...er.exe
windows10-2004-x64
1PDF-XChang...rL.exe
windows10-2004-x64
1PDF-XChang...86.exe
windows10-2004-x64
3PDF-XChang...er.exe
windows10-2004-x64
3PDF-XChang...rL.exe
windows10-2004-x64
3PDF-XChang...64.msi
windows10-2004-x64
7PDF-XChang...64.msi
windows11-ltsc_2024-x64
7Analysis
- max time kernel
146s - max time network
190s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
PDF-XChange Pro 11.0.1 (x64).zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
PDF-XChange Pro 11.0.1 (x64).zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/enhanced/PXCEditorCore.x64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/golden/PXCEditorCore.x64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaver.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaverL.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/HtmlToPdf2App.x86.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaver.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaverL.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
Resource
win11ltsc2024-20260709-en
General
- Target PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaverL.exe
- Size 34.4MB
- Sample260730-mx4tmagb59
- SHA256 b44b5b73b5ecdf55570351edcf6fa7b223b849db6472546ffdca99f0624ea49d
- MD5 aad2cf65d157b3b64bfc5fd38db70654
- SHA1 e7eae05b6268c1375e09066613fffda5e9d5b479
- SHA512 bef55380f694540f07e1aa5362a3d37aad41d4dab2f364839395fd92ef5b7c813a84aa32cc9f000d6191a69920aa33a11e9dacbca59d5a145db1111bc5104341
- SSDEEP 393216:dl7e3u2kMwbjmYzyGh+U9VlLFg1oJW2WSaZyc3MNvTGkQMyc:D7LMijryGUUNJvW7ncvTGkQMJ
- TLSH T11587BD80F68280F6C9891170952AF73FA7386F240B6888D7F7E43DE579326D23B39556
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdfSaverL.exe