31c6dd5472f3d83b4a6023cf929b475ded04ba5fa24b2d027fae3a3098b169ea

Sharing

Copy URL Twitter E-mail

General

Target
diff-pdf-win-0.5.3.zip
Size 20.4MB
Sample260804-gx7ydsec44
SHA256 31c6dd5472f3d83b4a6023cf929b475ded04ba5fa24b2d027fae3a3098b169ea
MD5 27b0601648e6692d820a7e880e9b9104
SHA1 8820618a641b4e3304526d0ef5eec9aa656bb338
SHA512 737e44e1402d56f852842a2cdd405655d5cd4cba5db302fa2cca332268b76dfbbbee0e0c8d843b4b6ef9cbeda5c234224ca6b9add9f72f04f3bb8ca9dbcc956a
SSDEEP 393216:wuTlGHVeledT3r538LziKqTZPsJSzIdSmUo/cbF9FPJLQpcciWwPclNp14HkaxRG:vI8lMT3rE2KEPsJSzY/ujRJLQp9jkclR
TLSH
T115273367917CB18BF0E3D02E8785AFBC829B741ECF92A51EB936027651D3222B77051D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  diff-pdf.exe
- Size 2.5MB
- SHA256 c116ac85297b2972c1831f397a53e2d10d4d51c29420974408d175784fd1403e
- MD5 bee4ba896c4c741bb771a71528a48671
- SHA1 2b288bcb9813adfe1937942d298f75d07d48354a
- SHA512 fd32301acd0a4aa566109ca60030e3e3fcd5ae843786ab9663fb0a2349212463aa47242006588963b1767b64edbe82f72afea0a8098acd9c8a83011e7101f5cf
- SSDEEP 49152:nbpzGwCM6FZq9g7dvFtGri44vZEBGo/wjLdik5UJVUirBDC26lG9D7GtnfGHnLs8:KQ9XHKeh5
- TLSH
  T18BC56C53BBC60CD6EEDAA779629F43511738ECF69B2A07B781149B248D831C82F27741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  libLerc.dll
- Size 785KB
- SHA256 3e3aa1d6e040d9ac93eb81cb5e472543f612373c3ab653ed2b2a86ab1d7c05c4
- MD5 12351ccc064eccec1db6c1fdb994dc4f
- SHA1 e8684f196d40a0f9fd521a8a2330821465e007bc
- SHA512 8935931d1dabebe51d6cdde86069ad2f970db75c05155e725672d5f1236ba6d425010327a9549987882e7fb5ec297bdef365777e63f2d3101aae4db290f3fd7d
- SSDEEP 12288:9s4UvZ5HuHhCXZx/s/fV4NL5fMjZj7vr+V5cH05qdVtVFoKd:C5Og3/8d8L+p7vrGUwWtVFoKd
- TLSH
  T14C053846E19361FCC15B847083B6B673B671385911386E7A9BC0EB341A3BF50AE17B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  libbrotlicommon.dll
- Size 141KB
- SHA256 c62c08223e450dfc2fff33c752cc228505ffd9d755201958ba800d5d30481a2c
- MD5 b7b370c8fc1f6c2dbec0b6063f469348
- SHA1 c867fb3e824f3c1acd0b0e7223f06d8cf968516d
- SHA512 18a757a29f5cab79178bbfbb5fe9b93f49bb038f3d608344af4690d920ef82d7a8dbf78b71c69c675852a94509124e6431ff01bc798d9eebb4a9c185e1524c91
- SSDEEP 3072:I8Hw4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBJl:C4AhdNorGvHdbi09GJPl
- TLSH
  T1EDE36B61F3051737C66B627AE49A6BB8F335817493634521B4A9827D20C3CA4873F6EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  libbrotlidec.dll
- Size 61KB
- SHA256 e270b6e576594ee8ee6e33ccc54e34a54304616dd6225652e11e49d6f17ef896
- MD5 719de82299491828886a7d2dd77e4e67
- SHA1 bba8350e1f4c363c119398a9c52fd09a412d0e3a
- SHA512 b694d01704a440c93a0e596a6d110d3cef1df2205df6bcdc91ff1854fa12618cb75cb9cf4ac563a9a4c248d0982b9fe76a5d1e66ad2f219e54295fc2918ffe18
- SSDEEP 1536:uuWfWbMA6E3H4lawsok5LTN7o8DpvF3b6c:udfXuYlbs/LTN7oaJF3p
- TLSH
  T18A535B13B6A3A8ADDF9781389B97D7B3FA367C041325DB3751C4F2312E22DA09E58425
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libbz2-1.dll
- Size 76KB
- SHA256 669a4bf9266d5f020e843aa5fd75b93ce8ebde27014d5ac466a8b3cf39d8aba7
- MD5 6b3421ee5222837efb4358f16ffefa90
- SHA1 1e04b9f81109d16e875bbc26707c557bbb3abcbc
- SHA512 5d27b5ea949264ab5480dca5dd11bb72a5f23cbb119984a23ee854435b0ed8d12ff4a539b3fadc1269dbe864a3379cc89ef95048df1627f825bbdca4a9148f06
- SSDEEP 1536:dEhYO5rt8z1kmtrPa2xUpvo1W/ykFk618RBRcSnbqQcmXdZ:3OFGkirPXkvokKkWJRBR/t9
- TLSH
  T1AA734B29E1D25E8EC553823091974A2BEFB1FC2C0B1067339654E17B6EA3F614E6D70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libcairo-2.dll
- Size 1.2MB
- SHA256 10cb3ddfb67ef352365d5cdf1fce0376693d2d6e90aefefee41b3c0c5ce363e4
- MD5 cc3609d0ee5a189b80565ca2f1e284a1
- SHA1 a6a00edc1480a6727569eb02ecb9f0c2b0ecef8f
- SHA512 593874f8f586e3775f75209a24183c259bc74a4545dd83b8fd38b4fe837a66bf1c1f0a4b930c1fe143b4e3f90b35431a539f90495c39672847428fb645454727
- SSDEEP 24576:vF+cd99WxxO/N9r+6YkMRF9y787j+3X8gdE06gxyOQzykK5APAom0:vJW4XvMo7AsBdJfxyOQzjvPAom0
- TLSH
  T132453A57E2A364ECC56BE0709227A773F521B4151138AD7F5698CF301F62E60A72FA38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  libcrypto-3-x64.dll
- Size 5.5MB
- SHA256 aa1395636511f373c780da484f92ece868a4b0eaaa5f259d14301b397968b36d
- MD5 c2f80a6a84416b312f8574bda8c58c0d
- SHA1 6a8405b21429144a8894e1a452cea0bd3f8b3f8d
- SHA512 6f1c073fdeb8657902867a2f3cc7be56d26d7ee6b65bda83c303e41441c9be178732d11a01e6e76c83f97a2731b2ace510b0b9c922f34d49a96068116614128e
- SSDEEP 98304:6VXzH5oLHQngWaMm+t5fWhrCd+MY+30bb1CPwDvt3uFOxClyWT+d:4tGVpCkEs1CPwDvt3uFOxCY
- TLSH
  T127465B2BE07B109DCA6BD1B0C26BAF73B930B81413747D7E6A54DBB01E61E5017AEB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  libcurl-4.dll
- Size 1.2MB
- SHA256 6b33124fc7acd0f50e7904e16e667752edfdc4d0260784b0d7b562853a616430
- MD5 8529dbdff834b772f1d070cd4550f093
- SHA1 dec1f8d43755b866fc008fe4313a52a212ab472e
- SHA512 dae498c9972c3291be5986db2337b18aa9fbcd7f0b0698baad9b20fff841a9ec45d7d5630cb14fe2b5ddd1f1ce837d84d7f590a078bf05d324fe75949516ef04
- SSDEEP 24576:aXEDG5gM9mOwknjaB+Yz9AEBzHMo3YmYS6gxd/X7SK/LgQ8YkWIv+vJN44oU:aPgM9mInjaBHz93LRa+xXmKTYdmxN44P
- TLSH
  T1F3553C67F1A320ECC267C1388367AB73B935B8182634BDBF5654CA312F91E50636DB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  libdeflate.dll
- Size 97KB
- SHA256 fb54be03668f41fae3f5d8bbabeedbc24e71b37e637e3cd34acd54f89f128ac1
- MD5 e7012b6ce5af978b96183ccbb4795d93
- SHA1 8f0b483ff31d63d3aedcad3940e0c45243895f22
- SHA512 bcc682f4e778d64b44caf22258f1a8b8c82247cb43afc784d08be796f028707d47b282634910ef2193854966dd083a6e18431d79686007b80b18de629c8c5f9b
- SSDEEP 3072:tRXnRsUXOH3Dg055/xRcPfn1vA0+0Lm9mNoJgzF3h:XRJOX8WKPfNA0+xYOJwF3h
- TLSH
  T16EA36C8AF5A374ADD2538170C5BB9BB1FA64784D62709E3FA6D0C3302D32E906B15F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  libexpat-1.dll
- Size 195KB
- SHA256 6a52ffd0ad364394cb1a9460b3c839eb1ac1c42bb0b15be0fcf3f72fc548bb73
- MD5 c4f191b6d5f6f98614a35bc85c5fe01c
- SHA1 fabc3dcc3c1c5b5c4dc67228105c5b82c29c522b
- SHA512 a0b6e57cafef71e6052ed6d763212d337725934677e390f71d3b7141a7993c845a39e603d3b8ec5f4b3df8d3cd04d916d5072bf0bd4ec757ff250b911eab494f
- SSDEEP 3072:L+804tpA0XWT8RFrLzpMt+dLm8tbPzTUNUgfHu4Vr9beH67TkwxMk2T1mxEmNt8p:y2pA0XWT6afHu4VOQ78cisuK63wQ
- TLSH
  T1DC143B57F1A3E4FCC56BC13493979A72B631BC300220ADBB6190FA395E23E60663D765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  libffi-8.dll
- Size 34KB
- SHA256 ccd1c21178c2e239eaa6c904a25c7f26efdfadb0faf344e62b1bbb39a30241d5
- MD5 8046e5199ae5e67c83c0024c011897ca
- SHA1 0516d55d2721837aeac22b7d266ec3c38a9fada4
- SHA512 81b17043aaa4f61982e03b969d22a7e80593b25fa9c43fda937bd9a216bfbe8ba520e892d9c281c6ac9e5a6d3bc48cce8246b2b232e8c7ed7407cc62059e8dc6
- SSDEEP 768:46eaB0N9d9xljfDA4xbDuvhJiFdg8QXAv/vIVKc:9jcxVxbDODSdgHXAXvIVKc
- TLSH
  T183F21927F6D368BEDA97C13094E79BB2F835BC100721BE7F41A5E2351E20A96971C906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  libfontconfig-1.dll
- Size 337KB
- SHA256 9fffc784d10b9918214d4a576b690418d8d4b9694d41d642b09ea19dd1daea00
- MD5 c51da751d8a040cf20f6b3c76897ae79
- SHA1 d628666f06802bc08bba7ed8430170914bf0c9c2
- SHA512 21d362c092ebf12c4999c002160a8bab811d47631086ddf690b79772fffb8e59bd5871df3537162e701af4884df9ae3c9e8a9a30f3efccecea1a339637af4ae7
- SSDEEP 6144:l1lFMPrGQN2hqpgCDS/nUDht7WjtQrt8PD:2iQN+G4MAtQrt8PD
- TLSH
  T1FD744A1BF28324FCC15B813545A79772B931BC250630BE7B6664FB392E71E605B2EB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  libfreetype-6.dll
- Size 773KB
- SHA256 a3271784f8366b3c6412e0c35474884fa12899c392bacb08bc8eac00f4be7e64
- MD5 55b083691068dd4c52f3d4c36c4db604
- SHA1 0ca79513fa39e0f168fb1204a5415c09edbdb2b8
- SHA512 1b0980ea56675e26650116176352756ee54a70fe8c8c145fb44f0f3608f0ec7a65208df8d173990a94b765cccc59e854d8178dd7b120da6edd8daa30b618eb36
- SSDEEP 12288:AYU6I381SzryiyeTUOP7J2lqU5LXrv6vMgrVUIhdiK8fEWm5Heudfh1V:AYU6IrzryWYOF2lqoiLLZ5Vdfh1V
- TLSH
  T1B8F45C53E2A361FDC76BC23443579732F931B8151128AEBF9590DB312E21EA0676CB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  libgcc_s_seh-1.dll
- Size 147KB
- SHA256 c658c94c8d59c50e77a4b3b790d595daedc5422e87170dd2609bed3e733a4000
- MD5 1ce92085e623c49b43f832ae95b8151f
- SHA1 90256f0383e29e6534c35c37b8de1f8f1b8d3718
- SHA512 34fc6b2105dab6accda732f7813a679c99c699b2cafa0bee2bbe3c2976375622f13d2f4396069a9bf8345edb033214eeee24116bba364c75998d5fa3c3cdda8c
- SSDEEP 3072:fbqrHiuAJCnu+FojovlYTYjRasceN7FAEf0bwDl90/5gbFA:QnuiojoNOeN7qxwb0/ObFA
- TLSH
  T1C3E30956F5D360F8D556E2309A939BB1E837BCB44334ACB31394FA382CA2F815629753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libgio-2.0-0.dll
- Size 1.8MB
- SHA256 5079e3ca8cf2193be15a30d30b81d573d739e6bae907492f9560f5c9623bc3dc
- MD5 08cb1d7f5e342dd60c42b24860e91614
- SHA1 bc050f619c131e167bb3b9bd7757f95317189bfb
- SHA512 8f312b095fcb43030de721981f5a133eb08eec165a33c4301bd20c02dc97091954e3ebf16c11df7b6002614df67943f155bc51dd1435e2c83ed3f67b878f30c5
- SSDEEP 24576:GORVwLs1VtSl+JpprUptzM+KgEWdmtIyN67QoiMXNQ/ros:pAw1VtSOPrUptZKgEr67Nd+/ros
- TLSH
  T17795492B9296649CCABBC2348597B733B430B4241631BDBF5924C7757F70EB1026EE1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libglib-2.0-0.dll
- Size 1.5MB
- SHA256 62196a7e69a65e52cf17a1ea985d4869d9228cf7a32e85ad898cd98d000b6af2
- MD5 539612ea874ae63d77c68bfbe60a3e71
- SHA1 e0d5e99d40c1d2d1dfaf6e5fa3b26f686c14049d
- SHA512 71fa6490d5a57e5c48dfa1a1efaec5869f0b7f1eae86af64b992f98b74ef08670239cf4596ccdc52d820b51d82f103422c518a1b31e02dca8fe0c7aba9b31e77
- SSDEEP 24576:6VFyh2opijva3u5ikaEup7Awn+E4VYfanrJItwXNtv/i4TlPA+N:6Vw/iLa3Iwpkwn+E4VYfarJRtvZhPA+N
- TLSH
  T15F751827E65278AFE75BCD3484A2A3B2E530B4140F336D7A2D9CC6752E2DD53021AF16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32