cb97626726c4dafed82046b314636a4e7abdd1aac485650e6ddccd6da2591951

Sharing

Copy URL Twitter E-mail

General

Target
PDF_Creator.zip
Size 29.6MB
Sample260824-rb255avtat
SHA256 cb97626726c4dafed82046b314636a4e7abdd1aac485650e6ddccd6da2591951
MD5 aae4bf2c534fd862705954f874ff5c0b
SHA1 982f10eeb665998e7fd3fb22e5ec33e82236b442
SHA512 5441d2790401b2f2939c9a4bc7a0a62445da1b8b7474510b022feb21bbb1a037c0db047289a5120e4904bc09ffb84ee0e861e39b95c5474742b350ebb92967ef
SSDEEP 786432:S6CXgeIBumbBA72SnDuHir7ogUuRGe/c3BKCijhd4rMbm:SV214uo7Guf/ek44bm
TLSH
T1856733F1B37B578548DD3B79960C9ED14490DDD0278EF5ABA8F2633900A1B132DCEA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PDF_Creator.zip
- Size 29.6MB
- SHA256 cb97626726c4dafed82046b314636a4e7abdd1aac485650e6ddccd6da2591951
- MD5 aae4bf2c534fd862705954f874ff5c0b
- SHA1 982f10eeb665998e7fd3fb22e5ec33e82236b442
- SHA512 5441d2790401b2f2939c9a4bc7a0a62445da1b8b7474510b022feb21bbb1a037c0db047289a5120e4904bc09ffb84ee0e861e39b95c5474742b350ebb92967ef
- SSDEEP 786432:S6CXgeIBumbBA72SnDuHir7ogUuRGe/c3BKCijhd4rMbm:SV214uo7Guf/ek44bm
- TLSH
  T1856733F1B37B578548DD3B79960C9ED14490DDD0278EF5ABA8F2633900A1B132DCEA1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PDF Creator/DESCRIPT.ENU
- Size 39B
- SHA256 3406847e961cf475a7578773d37dc44ae46fb0c02b64ee029840576104afec46
- MD5 e25a2724ee6c72e02049776f5205c722
- SHA1 55a3248eb70bb3f735e8c05d0b15a7874d56e25f
- SHA512 afab118ba918fbfc6e89e56ec6b0dd8a598276b3027c43100785c3e3bf47b0687ade6b5d71547ebd694c47afd042620305fa1943fd3468fa99c421f552b1a6d6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  PDF Creator/DESCRIPT.RUS
- Size 52B
- SHA256 b885070ffc03dbff029e13b6708fc2a953bba5c22d9c91e595b2a659339a791f
- MD5 ecfcb8f8bb622cb052c210b9be80db1c
- SHA1 5f173990b26646bdf531752a03a3607454a6a68f
- SHA512 c3e07a7bb98a6902cb608f57c002138477ac52db548cbfe5a9e4c6a355d655616242b7339294ba72fd6460b86a556772cdb7b13d34648a1395de3338a60b6785
- TLSH
  T1C49002447059B461114650BB84574224740D02D6741021315900C61811D95B58344439
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  PDF Creator/PDF.ico
- Size 4KB
- SHA256 af5b0acd3b70d1c1550d56efed1cfc834546d458df5be84c4a0fb001ef60e1c1
- MD5 7842bce841a8498e2eb87d13343dbcda
- SHA1 8388a9e1a048e841a0d833fd462e25e140a9b0fd
- SHA512 84a44432810708cff4a33b181e45b821a0a08ea5264608b2aa2c553a1eed7f50b46bfc5f99f7803146c8add23a3d6f41157b0896f10633ac631000e9c5483945
- SSDEEP 48:ZWIEULVTSxpO9bwkvKO/PvkLD9Tyj8lZTu:ZWHULNg89F/Pkwj8fTu
- TLSH
  T17A91BF4C667A062ACC0E8172CD1EEE103695EDD86DD767F1147FBBABC0B1B2530A912C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  PDF Creator/Setup.exe
- Size 35.8MB
- SHA256 6089957eba8969ee8db165550ca6bc7d47bf356eddbdda7e107e1740d9d05fd8
- MD5 6ce8b8e3548d3950eeb70c0267296228
- SHA1 7f0ae15a54fdd88fd575ba545ace45e0de0d69ea
- SHA512 7e6b68cab7a9f579c6519060f098bfd248788b32f4a792e1f6b902bb7e8cde652ba51bcb63af3bc46048d09644940507a8fc8dfe163f94282350792e6dc2a90c
- SSDEEP 786432:/F0kLl8G9laO6Zl2cBoMIB+5zGcBoMIB+cFk3PEdoBkEqgdkGdudtyoaU1d2z4by:9RVRM2cBoMIB+kcBoMIB+dE2QgxdWIth
- TLSH
  T1FA870211BA46C135D5D103B09F7FAF6E882DAF250B7044D7A3C43E6E6A317D32A36A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer persistence privilege_escalation defense_evasion spyware trojan
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  PDF Creator/SilentSetup.cmd
- Size 1008B
- SHA256 488503fd1331fc45db0813a32b7bd6d9cad8e276c33abce2fb936f4685d88ff8
- MD5 a546a7e1741d0f286ecfc6a8e3c803f4
- SHA1 1ec7663f01b6ed9fd99a527a7f1560b8949bcb2a
- SHA512 c0fef9b535af0ec5e3fde97ec7ab32022f4f8a5b86286caa909224e390db6866365ab0fffc54fc2d3e82d70bf31b9a62ef2362aa78028f1160d6d1309dba6172
- TLSH
  T1F5112631EC03D6E2342375E91F4529264240DBED23C519B63BBDDACBE095DD48B6E1E0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation spyware trojan
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral11 behavioral12