General
- Target 20260804142250.A7EABE4E1BAE.zip
- Size 4.0MB
- Sample260804-pdjqfsag55
- SHA256 ba2a39fdfb2c77a831f34664350f2e018b01e42c48f9518f050a1671c1f81064
- MD5 be11aa12cbf18fa01171bd7e619436bf
- SHA1 80492984606344fcd5966bc299a382281e753342
- SHA512 6bee4e331d5980c79d521996df2b7640fe61fa4c68854cedcaeb378de8edd608e41009600190dcefb89dc96592163537e3baa87e6e0081a2e366c73f62b414b5
- SSDEEP 98304:EKX9SvfcMt4Pypw5CC35H19HaM5nas4BQ9FzM/POVUWgn45:Eq99M6Pw6b31aQ74ByI/KgnE
- TLSH T11D1633B2DDA9150BB505F3772EDE3C6F8D18206360FE7E8E495B418FA08E857A841ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804142245.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804142245.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target PdfcOrE8.dLL
- Size 3.8MB
- SHA256 62b4dab833c0ea54fe9d4a65ecb1e705791bfe47b61398c0ea155d2445fffce5
- MD5 12ad6745dc4d16f4f8e28ab0594f9420
- SHA1 85bd848bb5c4375f711fd43fdcfd542708c018bb
- SHA512 99046d16d500acf36bdc6fdced7a63cbfa46cc023f104c709e49eea46ff8596425c47bc227c0195337b8a1e53b7cb6df9dea3880a04606df19739ad0a1b388de
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxxArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxxArDMxLkfIsEs
- TLSH T1F006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
- Target Vat.N0.20260804142245.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.