a582b03b4875f16b71cd6b1f4c9de3ad3e7b7d19fefc11826322750c472ee3b5

Sharing

Copy URL Twitter E-mail

General

Target
mopdf.zip
Size 10.9MB
Sample260812-c653yaab48
SHA256 a582b03b4875f16b71cd6b1f4c9de3ad3e7b7d19fefc11826322750c472ee3b5
MD5 cb4d0cd5e6a998dc9e08160a8e0f2665
SHA1 c32b5ff0bec380e1463b7d8c76b47d3d7be8e165
SHA512 c8f790551b3fdb6e44c2982e014f2980061e55c818ea2ee19fe6c1b8bac3194a1bd81659562e43b8ddd3e0252dd464cda47e949ecfdf82987fcc6628beff1d0e
SSDEEP 196608:y/3UTzNocSTfF+YCPq2YZZfzwScKpL/Fc9zGxnxIdlE96VpEIAFFRY84Lf28:y05sf0YCPq1sS3gGxxIdW8EIAjr4V
TLSH
T1BEC633F0C64C7353AF24AFAA07BA346940C2AF39746957D873AA1F1D25C32A7D1D3219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mopdf.zip
- Size 10.9MB
- SHA256 a582b03b4875f16b71cd6b1f4c9de3ad3e7b7d19fefc11826322750c472ee3b5
- MD5 cb4d0cd5e6a998dc9e08160a8e0f2665
- SHA1 c32b5ff0bec380e1463b7d8c76b47d3d7be8e165
- SHA512 c8f790551b3fdb6e44c2982e014f2980061e55c818ea2ee19fe6c1b8bac3194a1bd81659562e43b8ddd3e0252dd464cda47e949ecfdf82987fcc6628beff1d0e
- SSDEEP 196608:y/3UTzNocSTfF+YCPq2YZZfzwScKpL/Fc9zGxnxIdlE96VpEIAFFRY84Lf28:y05sf0YCPq1sS3gGxxIdW8EIAjr4V
- TLSH
  T1BEC633F0C64C7353AF24AFAA07BA346940C2AF39746957D873AA1F1D25C32A7D1D3219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  mopdf/PDF.exe
- Size 6.4MB
- SHA256 e4801235defdf5ae7c5e384d45ae867e7993bd5efc53ce26ce7df24a8065180b
- MD5 a7c0712280e99f86af05f4ec7b554c8a
- SHA1 d17bd856649f107698443365e4f7e1f98cafdb01
- SHA512 ac5fa4625636b9fb1ea76b3a12c61f8317f94f4118fe252aaab522aa4b42d91acc65fe5569b3bfda2d6df5adab44b1ae52c81a69029b0cbf11cb7ec50732e257
- SSDEEP 196608:RXF/qRAjmX+Pd8V3rYdZC/yjpUkYHDJAC6zK:RXFiRAjB8V7YdWKUkYjN62
- TLSH
  T1A0661261B281D330E8591075827CFB3BAEA96E39A714D5C7B3E01C1C3991AE25B3971F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  mopdf/PdfFilter.dll
- Size 203KB
- SHA256 874df2c1019efd7c87a64b911672f82fefff6f8f182ee30604c920e46e80fd2f
- MD5 335b09e89ba87300ef28c81e6d70a1d2
- SHA1 6c5abf52be4caeef4df65dfc2588a7c7004a92f7
- SHA512 5aa713e70b7c587fae941ac93848f08a1c47d1e73582adcac11473e51798871a86ce6ffd727ead2494830c35e9a2271d1f043a862b91c41bed22cb3b4939317b
- SSDEEP 6144:rzjNbQL1hw44lT9fOTUrb2FKSsuoDBGx/n:rf6L1hilT9fOTUrb2Eyln
- TLSH
  T180148D10B9C0C832D9AE1430656FDB76193DB5201F7899CFA7885D399E206C39339FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  mopdf/PdfPreview.dll
- Size 604KB
- SHA256 f21db05eeb971b05c3d5ab13c1a5309a88698c3ee29f5c32084da693a17e3b7f
- MD5 d2f82307fbb953d573f18d2005f99414
- SHA1 dade7fb23789547a36a40a005c96dbfffe0ed3f1
- SHA512 e8afe7eac8ce8ffc13f97e62c6e7a9bbcea4c61651abe5029e08a8b169970135347aff9b5805cbd78b5c9dc424d679ea64738cb38ad4b403e29dbba0a168fd32
- SSDEEP 12288:N6f3A0UHVmVgK8VYKH2lbfkCnaPDj/yv9UKMv8jkwdE4gJvQ2xRdCm8/DivdqV0M:N6PbiH2lbfkCnaPDeFUKY1n4YvB3Usqk
- TLSH
  T12CD4AD13F882D1B1E4A90030A27DFB7B597C6A3017185CCBE7D04D7969246D36B3AB9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  mopdf/SumatraPDF-settings.txt
- Size 2KB
- SHA256 2217aafe96b15370483ee735bfd201268926e4def7c8432edf9df5146c692244
- MD5 a88746a4efccfe4ffa6f16f5f020dc6c
- SHA1 cd368530be8e966b7d43ba71c9938d6c3b79b47a
- SHA512 3ad69dd9539e7e61a423d05ae8ece3ed9b6bf13124bf8ddf96a494a693961597d9ccab0f804ea034709b36d74b809687a2c9b8009c06734b1afb16e4c5e58957
- TLSH
  T1C751FE29350E603C8E267B29EE77E0330DEA7CA071DB7994B99A181C3450E5D82DDD4E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  mopdf/a.pdf
- Size 22KB
- SHA256 595902c7fb1b40776a12c71ebcdec5059031d4eee1125f68ec0695a3d7ed774a
- MD5 41c571bb768c30b19fffdd82abf58909
- SHA1 817ec5ec3a11e243079c94a285a1e89c019de428
- SHA512 67c94722ac4c53d99cd8c66f76265385bc4d00de3bbecbbef3ab0084b6efdcaf0823f32ba7553121b41d78e0209ade72a4eaca1f2a09e1374e4d4ab540069507
- SSDEEP 384:Sz+ELHDbQ6eifvBesnLzAP+4vsJG5Meyh8xoWFblUnJIzksbCsuKVKnMj8PvSdHl:oNzfwM4cG5nyhaaJPs29U8HSdHt4BwS2
- TLSH
  T174A2D06ACB3E4F58F2850775F56969B41CFA41C20A0C257231EC61A827B0F5A9473EFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  mopdf/data.dat
- Size 153KB
- SHA256 8cda370a8707bcdb2e58f358e4e814d3d2520b2a2ab88a0191fcfbc1e609e1eb
- MD5 92d6429a36a1d33970d02ceef6e2e952
- SHA1 14cf4058d5b89d47d53671209213d49edd9f7035
- SHA512 f6330b7081937d9951dcff2347aed98eb20197f47323cd9229120bd58e0d6ec2ed38b5fc13ef7cbea6c9ff2daddc4700ea9d9a8b520c3edea9d8673342d78c0d
- SSDEEP 3072:UbPjIT2aIhMXvviQ0Ft1a67wK0uINdJKU+wylK2T18B9w+abtD:UbPjvaXniQqt1V79TYSwyl7T1xbtD
- TLSH
  T1A3E31228C7060616BDB77D04CF67026E2A6073A1E05CDC5EB5ED0FD3226A13BDE9D0A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  mopdf/libmupdf.dll
- Size 10.1MB
- SHA256 4c155f0415d8a4a9e3b668fd9f5d8f4be530fbe71b5f41e09b5c5ba8201d3205
- MD5 29a9ed1b59d22538b26195cd61390310
- SHA1 d0fccd8316745aad28620effc78cec9c74bad83a
- SHA512 bdcb1af02477d0920d65148405c979f1dc1bb224571abdfe89762066134ca01d73616fe7959514a2a9bd9ba1003d791ca71f9307f70aa8f26f67230c62c36c22
- SSDEEP 196608:AKBJwatT4G3M2gdpQy0GvJ4Z08RBCxXB7q3oWhCYCQXBv:rJDgdpQy0Z08RBCxXJq3ogPZX
- TLSH
  T199B67A62B5819E34D241BF7CD95143BEB20DFD185B5682C386DA2C706DB92DA1C38FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16