d2306pa1[.]zip | Triage™

resource	yara_rule
static1/unpack001/dvt-11th.2015.exe	aspack_v212_v242

resource	yara_rule
sample	pdf_with_link_action
static1/unpack001/d-000pa.rar	pdf_with_link_action
static1/unpack002/HDM15Pro_UserManual_eng.pdf	pdf_with_link_action

resource
unpack001/dvt-11th.2015.exe

d2306pa1.zip

SHA256 1bb75dc2e89b9b7cbeb8a46dae17e0eaef414206319ba8b36201fa35912b7ed4
MD5 ba7cb9047cb8c221b08d9f4fb9d6521e
SHA1 9b1d00eaf57079952c506372acdd886e433e5ec5
SHA512 85dcdeab47f7e0221a8a8784a540baf6b33849310e9343d88cdde2d0532952b372034cbcc33c8c7b9051b8147fe1fbc8f759bd4fb3e28d14a898bcae00b8c904
SSDEEP 196608:HLcDXxaGiqR3O5ig1oNsycThCC+3WhiXjKyrHk7QxjgXGf2:HlYReF1oVcThUGhMHk7sUWe
TLSH
T1E4C6F020845C6CEFD3561BF12B1F3D2AB86E7172F1CA57460328C7865261A7FA503A9F
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

d-000pa.rar

SHA256 e02459db62b00f6505b9111a76f9298334266c8a1d6a0fda58be3facea8b52a8
MD5 2c2ec551f05fd323fcf5ce531f411490
SHA1 09b5d127ee98226bd2b9b327ca8dc25a625af1b5
SHA512 13de308e487732f8e1bc5d5aec9544aabf918d08e362172af8cac24badc68b71879bf148f352dd45bd87c65e7fece3536e0da05bc38e2b9341e902f666fec2a5
SSDEEP 196608:ZLcDXxaGiqR3O5ig1oNsycThCC+3WhiXjKyrH:ZlYReF1oVcThUGhMH
TLSH
T1B5A6E020845C6CEFD3564BF12B1F3D2AB86E7172F1C657460328C7865261A7FA603A9F
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

HDM15Pro_UserManual_eng.pdf

SHA256 3024f3f494487a72a261cb2413d8f05be68bbf39e4ea3fec85d73331ce45c41d
MD5 53a9387904408f71ddc1f38941734e37
SHA1 824c4d9e71709a9f39a746c17d741e5ef8ce3e10
SHA512 e36bbea8757d7a710a1b80fbec44cf2327d81ac1e746c3d3e22d39944a3e6fc3136d6b3d2aa57948769d73fe69e1e61077a2193a4a854350f1ecd8202d5a5975
SSDEEP 98304:N+MsLMvDXLh7DGGiJEOnX7dY316JFIq54Px1et1oWw4ViNTIdyZyXoGRFN77VpL4:SLcDXxaGiqR3O5ig1oNsycThCC+3Whi3
TLSH
T11B76DE60846C6DDEC3565BF12B1F3D2EB85E71B2F1CA53450328C7861261A7FA603A9F
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

Extracted URLs

file http://kb.paragon-software.com
file http://mail.com
file http://paragon-software.com
file http://www.paragon-software.com
file http://www.paragon-software.com/
file https://technet.microsoft.com/en-us/library/cc938537.aspx
file https://technet.microsoft.com/en-us/library/cc938537.aspx.
file mailto:[email protected]

dvt-11th.2015.exe

SHA256 4efefc8403d96383c09c3f5a0c03e2dd5d641957394b918d244e844e2a524572
MD5 6333b5949ee365cc0d352aa35e4045dc
SHA1 925ccf670814109e37a3d5f404b14062b82c7a11
SHA512 a9d243f7c4d13d65cf9aec5abf3898bcea2f6c1c92dfde1d66637cf72f38eb615e8047ecf16c4a2a879631051acbca6f61e6957fd1a00b354f60b5bad281e8ee
SSDEEP 6144:XgvIMQy+BikkTf+4sCBCpvEURk727C0q8X3w:XgdqAkceC1Ua27C0q8nw
TLSH
T123F4E1F178D84A39D50176FDAC62E62287841D24A00D5A222BB8FA455773F5FDC33A3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13746177

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.code

Size

15KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

114KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

205KB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.modplug

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dvt

Size

366KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

dvt-red.png

SHA256 9d47c59e400fecef60aebdd5dc4c6b3a54e2b42185bd561ad3b7fe89a14bcbfb
MD5 e79773854d827cc46478e781f3b36ad3
SHA1 43bd0d86c6ba6587c9e619d09304434ccdab3372
SHA512 605251faf13dafb8e06013681e6fcd0d6e83f112e349505d648e4dd88f4793c9a9bfcabdf0871c1954bc29c007935b449f14e3ae1171fd5697bed047db55cc8b
SSDEEP 49152:CCJ8IaV2cHTHxspJJ/ntg6Yp3Rt80Ipiu+kv7/koJIfL:Cc8Z4cd2J/ntgT3H3ImocL
TLSH
T1A0C59B45DCF8A8C1694DB74A90DC2C459ED72EC38C20252EBBDD9CCE4F029985DD3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

dvt.nfo

SHA256 b426f1710664128da1f1ca03d827b9a7099463964b1aa07985416bf6d2904d02
MD5 8feed2daa8569693b26d96ad8bcb0fe1
SHA1 ea4fd646588e3594a23b7470cc49b0033f74b8f1
SHA512 0b4b0abed8f81908fe227fdaa6ceb10fa98ef0fbf4a87d79ccf63b8bdc2b12fb160c88dce338b86588ea387b6d197695b2b3c7014f91022461ded90e5125e961
SSDEEP 384:Wnd5CQ+F4z+pr8XFz+48z+ok403JPzR9+n:YPi4c4VZ81903JPzR9c
TLSH
T1A3528A27B157EEE27B102AB2505C0A88A3F5B04E293D5372365FD5327717D68A0EC36E
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

file_id.diz

SHA256 c0feffbb1a459f5b544a8e0d87eca76038ca7822121cf4f8143546a597c45881
MD5 f12a2b08fff4fd69a6ce143021edd919
SHA1 9704f51c6fe347b41ee94bcaa409f09489a14af7
SHA512 00a347860c928d1b9c4080343830e85f0e5747f45bbe776ba73cd554095ce477df6e10c5c9b8e54b01e618ba5cd866e76c3407adc916bd6fb0f0bc8c0d18965d
TLSH
T167F092D54C4580120DBAF3F68B97F20EC959205FC7458995337C0BFD8B36A870A8D0C6
MD5 SHA1 SHA512 TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

Sharing

General

Malware Config

Signatures

File Explorer

d2306pa1.zip

d-000pa.rar

HDM15Pro_UserManual_eng.pdf

Extracted URLs

dvt-11th.2015.exe

generic

dvt-red.png

dvt.nfo

file_id.diz