General
- Target 20260803122857.D5E46FEDBAFF.zip
- Size 4.0MB
- Sample260804-ak55pszdqc
- SHA256 58ed95b086bd13802ce95918dd14c3b796b89e46da663d578524ee54964bf019
- MD5 6ef6d62c4868341b8f57855a34a8e77e
- SHA1 9c2905f8bb1c8988bb849ff7e8ba76d49e8ace49
- SHA512 f06674fade5a408a6a958b1e1cfef65323f9f9429c99b2c70435be55d44fb858080112333c41f1ef1fa28eba8d26af2270d95067ebb88810b14a82bb23b85914
- SSDEEP 98304:G9g5InQxHnUgLCGjU/7zdRKP9M4p7ZQt1z4E2W:G9g50QxHUYjU//dMP9MM0shW
- TLSH T1B31633F4692866B8D6DFBB73065C36703882B2ECAE4AF400244F858A777D19135D9BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260803122837.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260803122837.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target PdfcOrE8.dLL
- Size 3.9MB
- SHA256 c560a9957a9be6751d764fee087c107961a2edc6d19cd689fbf6a5bfb59d6f69
- MD5 4c4733d0d26b8b895f73b29101b7b413
- SHA1 56c0537199279e6479ed68e2f29d6ce8ac89b5e0
- SHA512 f6c10db65ae6b545a0410af50f72dafbab61e086b31dfd058b893aca5552238fd338732618bde6cda3baa92e7d1c01463c70ebb72e71df7c0a51d32e00279dc2
- SSDEEP 98304:b2xliJQ4DUrfgJuVUwpZfUCcabgWShAYbyAdEOzutKVlnfSzPyi7:b2xIQTBQabgWShhbyAdzzvVlnfs/
- TLSH T12116D0123D8042F7E42A1370564EB7BDF2BDB7B80BE784C7E6D0E64829724867126D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target Vat.N0.20260803122837.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.