General
- Target H_L20260804083934.zip
- Size 4.0MB
- Sample260804-pjghaaem5z
- SHA256 eabb84ee06b664ae393b28e2847c1778fd875199c4b53d05f7c1cbf3443fb671
- MD5 fb8fd1358007439d80f1663d36d50001
- SHA1 8a66a8be3c7d3ad60790aa91748b608d29e02628
- SHA512 eadd4b31780b1b1bdc3dd0f90c29018235d23b941b64ebafb76a82e3856ea5748ec1f9ca1c0118bc5a252cbed2f761ab763a83e62d05cddc690a1438b72145d4
- SSDEEP 98304:ua+XoXTDezG+Jntl0QaysVQM5nas4BQ9FzM/POVUWgn4Z:ua+XgTDhM0QayQ74ByI/Kgn0
- TLSH T1A616332BFE446A863509625D8F8B0C580ACF31B6E0733E6DDCDEE257CAD815B0096DB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804083929.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804083929.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target PdfcOrE8.dLL
- Size 3.8MB
- SHA256 343b00dda5f495bc1516c463e06e7514405f8f8c7184faeea6bc77f650fc4b17
- MD5 2168804a50029f2c701c8af2dff102da
- SHA1 015b16ab82a4161d1dcde0f5849ef219911ecac1
- SHA512 fa51302b6a078517251eade04bfa8bb9457e0d26a66f2d197d30cea1be502b111ef18e3d3bb5ab11ae598337e976ffcdc65f5e45635b38d56f6f3cd88584b188
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxlArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxlArDMxLkfIsEs
- TLSH T18C06D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
- Target Vat.N0.20260804083929.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.