Analysis
- max time kernel
599s - max time network
605s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:27
Behavioral task
behavioral1
Sample
-A2026804002105.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral2
Sample
-A2026804002105.zip
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
3 signatures
600 seconds
General
- Target PdfcOrE8.dll
- Size 3.8MB
- Sample260804-w3tehsxdkf
- SHA256 f856bcab6dc2d2c4a047202d301f23b6b9e9ffe5ef5c85b5431bff69442ae95f
- MD5 7125e2d1c3f52a4217adbe4140a1c36f
- SHA1 08a9b79fd07a624aa9d74eb76059d2a89ba08bf1
- SHA512 3f2537b9486cfbbe376c7d8d28315efb804713f061dc5f624b8705eb41a8be8d50ec082aca325f56c789477144da7bf0bb792bd3cce9598f9df04e81be54fafb
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxLArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxLArDMxLkfIsEs
- TLSH T15006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 37 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 2804 rundll32.exe 6 2804 rundll32.exe 7 2804 rundll32.exe 8 2804 rundll32.exe 10 2804 rundll32.exe 11 2804 rundll32.exe 12 2804 rundll32.exe 17 2804 rundll32.exe 18 2804 rundll32.exe 19 2804 rundll32.exe 24 2804 rundll32.exe 25 2804 rundll32.exe 26 2804 rundll32.exe 27 2804 rundll32.exe 28 2804 rundll32.exe 29 2804 rundll32.exe 30 2804 rundll32.exe 31 2804 rundll32.exe 33 2804 rundll32.exe 42 2804 rundll32.exe 42 2804 rundll32.exe 31 2804 rundll32.exe 28 2804 rundll32.exe 29 2804 rundll32.exe 33 2804 rundll32.exe 52 2804 rundll32.exe 53 2804 rundll32.exe 54 2804 rundll32.exe 55 2804 rundll32.exe 56 2804 rundll32.exe 57 2804 rundll32.exe 58 2804 rundll32.exe 59 2804 rundll32.exe 60 2804 rundll32.exe 62 2804 rundll32.exe 63 2804 rundll32.exe 64 2804 rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4972 wrote to memory of 2804 4972 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\PdfcOrE8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\PdfcOrE8.dll,#12⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:2804
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5HAMWVT5\2c3f3c46bd764335beec466a0acfde0e-png-w639[1].avif
- Size 21KB
- SHA256 b63fe4974797e62d3f3c858af8edb0f3372e025546bd2546f97bdbc965c42db2
- MD5 5539a18d3933f1cd3f8fe1ba70a62e6e
- SHA1 09fd39ae79c38def6f3e9950aefbe25dff2c8252
- SHA512 4cedb4a01ceef0e6303721cce5828e638417a01a2256b75c53bd55618b98b84afe9dabf6b7f6b4a8a4f4c5b382d6f2ae821b72b72e22464e32845ce36d4b5006
- SSDEEP 384:rxoPot9fJ1onzJQn9yciLXBopp0r2elBcmTotSHONNXQliokZF45+J:1ZgFQyTW8umoeONhkiq5k
- TLSH T147A2E19B25608E0ECEEA7E30DD15530ABD70E7E6845F93360E076BA6C372834927525D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AHRAY41H\f0a9c774-4643-48cb-b72c-f3f44c23fb40[1].json
- Size 88B
- SHA256 24d3b24ad60e1ee26bce45e7bab18698dd9f4601ec5ee27f6e8f93dc320babdd
- MD5 ab2c255de52ca5207c8d1814b56daac4
- SHA1 d25552f5fd349d74311f5194126ca2b469f0ba3a
- SHA512 2339ab8eeba220b2504e88dbde25c106759fc80c92e20666be2dda062ca82057ac5891de0c87a247370143f52e4121971170dd86c624617998a5c4a639f7110e
- TLSH T12CB012B0B342304445396139890114E0041F0113440CCC3941218C60010C0273C24513
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AHRAY41H\segoeui-vf-display.BxQqxUD_[1].woff2
- Size 118KB
- SHA256 98cbef7ed37298ede5c635e8b58b4f8d89b6c2211a4d10b6723118f0812b87e2
- MD5 5c8aa5a64fed9dfbbc13261567c5d890
- SHA1 0c89ea5a55eb53d37a0a196f02af34bd2f140376
- SHA512 46468f5f245a48c4d2bdea87015b1caeb56c86bf33bb3e0c94f4672b93d7dd46e618493e589d3bc231527b92b3909552e976f38fe6d159483cace94b88bb344f
- SSDEEP 3072:UGc/UmuFO6UIK4TXP5GdjGYVrx9pywimZKPQvXLIWMZ1:Y5eKuXkdjGYVr5ywRrDIW+1
- TLSH T180C312B64F36276656A2F8B63D50B2F1D96443093B712477C53D91CCFB8D084C48ABBA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NYWQ12\bat[1].js
- Size 53KB
- SHA256 855230e1321917153b6859521e1ccfab0dce7497f88645e73d7e6db9c4bbe3b1
- MD5 d9200f6aeb863daa8622d6d04b6439ce
- SHA1 27f04243174adb38dc4297bf48df84bd6f81ee4e
- SHA512 8bed70ccf60061743fb71be37b2a56cdf918063cd01fb33d0d2edead3e1270b27a2c6d92735c08ceb542c71d4df4b8e2f09c84bc16a0df5a8563f0e33d155e9d
- SSDEEP 768:YcMOGhicg/XNIh5HQm3mT1koLQBExf6ybGVGOjJDuOk:TMOGkcgVE34Lbxf6ybGMic
- TLSH T104430B4333509A7646F9419C786A2903A336570E30BE70DC7A8CF8E6945DE4B7237B7A
- MD5 SHA1 SHA512 SSDEEP TLSH