dc3af93af5c64dc115409437d31018baf2c3c46167806a599124bc905ae512f6

Resubmissions

10/08/2026, 04:33

260810-e6g28avzdt

10/08/2026, 03:53

260810-efqaxavvav4

Sharing

Copy URL Twitter E-mail

General

Target
microsoft-windows-netfx3-ondemand-package~31bf3856ad364e35~amd64~~.cab
Size 68.0MB
Sample260810-efqaxavvav
SHA256 dc3af93af5c64dc115409437d31018baf2c3c46167806a599124bc905ae512f6
MD5 d274cbf7737943530a9499e076f35cb6
SHA1 a8eff638b27065acbba46654f2ba01d08a569ba9
SHA512 852dbf7137ddf6164c06641adf725781f09c8e55d88818b99e96256e11e4584aceb95ee7c7fa7027fd92450cb59923e5ea502b2d5d78b4a0caa046ffba67b0e5
SSDEEP 1572864:zNLipjIikU9XIUYADnNzKuP9MMqhVd9UpaGxAlKu:zNupE0IRAD3PqMqhVd9RVlKu
TLSH
T12FF73300A6B2CA49FE175A73B1769E3BE46821133E8185EF7D41EC512DC3E92B76C931
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  microsoft-windows-netfx3-ondemand-package~31bf3856ad364e35~amd64~~.cab
- Size 68.0MB
- SHA256 dc3af93af5c64dc115409437d31018baf2c3c46167806a599124bc905ae512f6
- MD5 d274cbf7737943530a9499e076f35cb6
- SHA1 a8eff638b27065acbba46654f2ba01d08a569ba9
- SHA512 852dbf7137ddf6164c06641adf725781f09c8e55d88818b99e96256e11e4584aceb95ee7c7fa7027fd92450cb59923e5ea502b2d5d78b4a0caa046ffba67b0e5
- SSDEEP 1572864:zNLipjIikU9XIUYADnNzKuP9MMqhVd9UpaGxAlKu:zNupE0IRAD3PqMqhVd9RVlKu
- TLSH
  T12FF73300A6B2CA49FE175A73B1769E3BE46821133E8185EF7D41EC512DC3E92B76C931
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  x86_wpf-windowsformsintegration_31bf3856ad364e35_10.0.26100.1_none_9af11c402bff3ada.manifest
- Size 356B
- SHA256 6ccb5aac5c72c86d56618751b97ec4bacfc578cdbb23a142870694354c4979c9
- MD5 c202ee858ba38c0e4372b76122ac3bd2
- SHA1 b301829c3b5ab06a356a87fcaa00a433c0ebd252
- SHA512 b119f86deedaea9bd927094b297aa2bbc2041bd4b764e8f0b51791512ab0cd8eca168341ceeec6aa373bb5cb9e7127dd73f111e67966327849f088110209748a
- TLSH
  T177E0C07739FE62C16FE377E852C066320A6D91786810FAD83452A06B397494E2D03452
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  x86_wpf-windowsformsintegration_31bf3856ad364e35_10.0.26100.1_none_9af11c402bff3ada/WindowsFormsIntegration.dll
- Size 92KB
- SHA256 f1242979553b98e1f1e37c51b6f5c2f898299f7d863a26344237b7b3cfad69bd
- MD5 0ee48369456053ed166646e7f67170f4
- SHA1 ba5e1427c5d1bf13765c07a07c8ce3e7d2b0049b
- SHA512 5246d69f15a077f88303a3aa868400b5cd39945e0b5e028ca9de13f49c2c33b57e95011ac81480767b6f9f97b1c3c40e8e1f829537d3ba1379de90a551e362bc
- SSDEEP 1536:ByYeKFIJ6FfDCR0fZuQQQqtaxOzs80T8ipUgZUHpHLSuiyc5w0rIBcAU7UFlcHhM:EYeKFIJKru0xuQQQqta0A8C7pUgZUHpf
- TLSH
  T19893293927ED493BD8FFC235E8F411535A31A643B663EB0D19CA439C59933816A813AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  x86_wpf-winfxlist_31bf3856ad364e35_10.0.26100.1_none_e1b1e041a0383e22.manifest
- Size 325B
- SHA256 c565e9365d4e1287eb44364320554b6bcf00a6c7bd6b432d799609b0add5b00c
- MD5 003d7bb7e92925cccaa132b29e37b153
- SHA1 589ae03f93562f09596d8d90433d5f4fb6b28418
- SHA512 c9a1f06d51ad24a904d466617c8d089c8307075c7a8d2449a803025d20aa6502b3b99949412b594585b2a4bad921524f1e4bbc76c096d3534afbec4e6b28352a
- TLSH
  T1ACE02DCF9D997321029BCC983FC824228C2B3F30FE025AC4B920C07080A6AAAD080992
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  x86_wpf-winfxlist_31bf3856ad364e35_10.0.26100.1_none_e1b1e041a0383e22/WinFXList.xml
- Size 2KB
- SHA256 1f19e1e9f6197d5db5f5605d0836a3a2199cb226b6eb42674eaa466df4ab55c5
- MD5 41e97d48e16c4fbd247224280497e920
- SHA1 7f01d03133a4f7befd83d6150658807eeeedc8bf
- SHA512 1a3c76bb3672dd224ae12e3d07a89db79380f8fadee92dba4e486ad36c6e8dc3bc9f11f8cb349963365afcba65e277ad5d0e3c3eb5f358a273029fe244ec06f0
- TLSH
  T1D0514650F0117CA04F8B8E723BA657AEAB780551DB450B4AF13375EB9F0881E37462E7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  x86_wpf-winfxtargets_31bf3856ad364e35_10.0.26100.1_none_6a0ca177521260c4.manifest
- Size 302B
- SHA256 e190388d8b60e49adc5f748ca74d14b7f510d98cfac3b3aa0e6ca596f7097d93
- MD5 526ee0292ab0507c2a858b00392dcf99
- SHA1 83a7a61e01060be787765bd7096cb93401d41435
- SHA512 f9520028cee978282b3226a93f886924726887c9c5a10308e22f362f929564e45a69ad26156ad5ac4b4cff8844732b9bbe8453aeaac11ce7ce4bbfa3d1c24bb1
- TLSH
  T1C5E07DAB60A621585A9B234560C43C324C72ED507098745A149A77B902048680B50468
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  x86_wpf-winfxtargets_31bf3856ad364e35_10.0.26100.1_none_6a0ca177521260c4/Microsoft.WinFX.targets
- Size 44KB
- SHA256 e0212edd10cdc5e036f95ec6b839eb265967024d55f2a6acad7dcc292114efa9
- MD5 8524b6c2355e3b75933d1a86a3d60e0c
- SHA1 a34cd7aeaf3a20b0a47554e171922624f3a9d75b
- SHA512 789a9b154b6cd047053983a1a52122d38413e7d18642d91fbb39ddde465c75ea933ebd62b74989f653338682bb8350bee6bebafa9c33ce21d3978a1b9643bc30
- SSDEEP 384:F5iNFRGVJMDbqbbEQbtFoFiFWFYeBKfMDDjrQIQ4ffkVioSEMbM5tUbh0UbL2tF3:FOGs/efbYmCY3r4ffkX0iBeiDKkS2X
- TLSH
  T13323A6166847AA74123102A3BE734599FB3841FFA1644994BC5C2A5BBF73F200167FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  x86_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_f6e3595e2d1c0bde.manifest
- Size 320B
- SHA256 a6c920779031ff88740b6e4f5141f1be66c33ba328beb8b7c0a75d0f3c0b0d51
- MD5 429c53a615b1561a9d30a94a89d1bb5b
- SHA1 a7e7f29473c51e2f4185ff33839de7b5de069cc4
- SHA512 e796753c5b1f5be40d53683d3549c5afdce72ecc8d173cc1560b3c1ecfaac2328b07200e9b7d4967c9390f0b5fcd71d754a900dc97f5ae2a9cb2e100c01cd978
- TLSH
  T1DEE02DB03924B16809066C767971E8B1CD77F1401422EE311BE9F7AB04AA9A0D4F4819
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  x86_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_f6e3595e2d1c0bde/XamlViewer_v0300.exe
- Size 24KB
- SHA256 89dd85b56a5a25c08a8199d58e0e6db11704289b99b44361f761ae02bec320fa
- MD5 f6c1c01efe3ebec581211ee0b8a743fe
- SHA1 fbee9b5cb54be880ac2b60d0fb8166cf591b1da3
- SHA512 ee2967884a1c26779e356e85d4a7b1c45e57d140252194f283d2dcb312ad18143b18f42337bfae46ed8f8f20788fe4a78439c6721e9206005403da744ea6113d
- SSDEEP 384:o1MBXhZjmDZBv0xAXO4Wv0Wu1D/HRN70s9l311:Zd5iDv0I
- TLSH
  T13FB20A3D1EE81223D8BBDA70D9F495C3FD29768339119C1E10D793960D93F97AA8221E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  x86_wpf-xamlviewerapplicationmanifest_31bf3856ad364e35_10.0.26100.1_none_095a448b810ba607.manifest
- Size 320B
- SHA256 8a204704142a9b7f8ec02e059d79e3d0edd7c945dafcd8b29b9e3da5f34d2c69
- MD5 8fbf650b84d39640769d9260f9b8dd47
- SHA1 811450a0f598f7f9ca9680ebe3bda8f15cffb870
- SHA512 a9b47291bcb543a891e4803e1451dc3e82bf965d2caba068a723f1e4c75aad2f512ce90c3c8d7d04f17bfe51c787c6ba2135e19bd82cadd8786a606b9d651c50
- TLSH
  T1B3E07DC628F04520BAC675D8316485E3857E2AA92806D28809F93232C27AD987D3D793
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  x86_wpf-xamlviewerapplicationmanifest_31bf3856ad364e35_10.0.26100.1_none_095a448b810ba607/XamlViewer_v0300.exe.manifest
- Size 4KB
- SHA256 af0346cd519b7055f8307d511a1a140ff7a105e3b3bf8acfeded137248036fee
- MD5 bf79974633ded21fcb51f6a77bf2850b
- SHA1 ab102b838b6c10ba2be6e79756db71c1f5cec993
- SHA512 20b40672d5dd3bee8f6479ce08ad33c6d16419c02cb00c7bd8b13007e7b58550c539dc480ba9aad0bab1a84d1afb9860cd09ccc3fa453b80efbcf1478b2630af
- SSDEEP 96:xWt41jhG6KBdKrZBTR/1tamcerSyD/6ikE:oHZBdEZBTFramce1/6LE
- TLSH
  T14CA1422280C8B575477282D139B2E611E77B639B26CD099CF86C455FAF269CA87432B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  x86_wpf-xamlviewerdeploymentmanifest_31bf3856ad364e35_10.0.26100.1_none_0842c09d7e8bd454.manifest
- Size 319B
- SHA256 aaabbd5cc86d02b139bf0ffe70a5cc69d751b0e7e4ed537c99e895ebf59373d2
- MD5 552598f09d37d3edfa3c8cc0fc076f99
- SHA1 e9bd8695a46ea454904e2cd69e35e045ce8b7532
- SHA512 349a303d3cc7d1ea389f8a0c027bb442c9288d80adeb92b8145cea7d1e749f69fcd32288fd11347a8e3520a91559cf616b031366ebba42298a5d626944537a1a
- TLSH
  T151E02DE920C8820321A286EE11407C31FC028C10BC00ED983BF829A167CD5C524CA1E2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  x86_wpf-xamlviewerdeploymentmanifest_31bf3856ad364e35_10.0.26100.1_none_0842c09d7e8bd454/XamlViewer_v0300.xbap
- Size 1KB
- SHA256 39179aafb375850f6c304553dc20611716c5aff86c544fa5dabc34932f9e119d
- MD5 2c5152f66ccea4c918cd743ed64a1fb6
- SHA1 dce86aae225cf6185e1ac0e6934d83b4600f9a9d
- SHA512 e73312d741cba3ff3e9381fc206d590d9ecd2ea0b7789acede915c937cb654ab46db96ef662b9685b2b41ce46334a0c4b90555fa3419ea6c5f48f6fa7981dec8
- TLSH
  T1AC31BE40C585B85AE712C0A0B9D2F413675AB76704DC459DB8AC9CAF8F5BED9CA031F3
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware persistence ransomware
behavioral25 behavioral26
- Target
  x86_wwf-cperfcnt_31bf3856ad364e35_10.0.26100.1_none_c0722a77b0b689f2.manifest
- Size 294B
- SHA256 8703b66ef6690a0e6aa42dc38d75dbfe0d520e5738fefdd2b5c734b38a9dc0ba
- MD5 3ffb1a8b22b6c23bad2df13785b80fc9
- SHA1 a007e1fb20b71bbf91d4052d31a9434e797aa2fb
- SHA512 47025e75e571763480b6f9f69ce4567beace0b85da219d8b159213c759fef15de1400e8ca8e37333e2f5c1a9f5d8d4b8c98ef1fe223ea92c77f8d6bee0e9ffc4
- TLSH
  T1A2E0E7FEE416F40448D35DD1B111D4755513FDB0DD775712CCBC4921C36C51E1186111
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  x86_wwf-cperfcnt_31bf3856ad364e35_10.0.26100.1_none_c0722a77b0b689f2/PerfCounters.h
- Size 844B
- SHA256 e2475596a99b91611f479c214cbabf0a67d6ac045c15df9cad5f69796c2db25f
- MD5 fad96297c46bc16bc84c98c069a2969d
- SHA1 aa2080ab6cc8cdf7b2cae5f0ef4e1b34a9316f91
- SHA512 f6bea5abeaebdf25eedbbe06709ff4931923b4c1bc6b72e9be3a8e3145559e17fed116c528429f6026ea485ccdd17a5b5aacf90fd9436472debeba0ee804d3ce
- TLSH
  T1EB01785C4FD210FEA7ECFA5401585A518027F82B641723DA386AC91E5EE73E220F30EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  x86_wwf-cwetargets_i_31bf3856ad364e35_10.0.26100.1_none_4130d3df8907c690.manifest
- Size 402B
- SHA256 566c74033815e1bd63cb53541612e4b602756429658765595ecf8146f900595d
- MD5 a56ceb8804ef0c066defa7a5cbc20e2b
- SHA1 1b477fa533f5c7bbe394bb1ee3219a36d78d5eaf
- SHA512 d881c0d3054b5de36c163d00ded20b99dab3f443bd6f4a7acb0d4ce87f222aec242a605ea85ce64b9043a585ddfd9e7f6353ffc6dbf5464fc570da7bc07950a2
- TLSH
  T139E0F1BC97201691B1DE65F2340F2156230218345C033B46ADE8628636F8C378883612
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32