082de9f2a950ce61f9bef636a4841f0e9a6c1cf40772bcf9b275c5fc92a63272

Sharing

Copy URL Twitter E-mail

General

Target
_OceanofPDF.com_Poison_Ivy_-_Steffanie_Holmes.epub
Size 1.4MB
Sample260909-dn5j5a1tcs
SHA256 082de9f2a950ce61f9bef636a4841f0e9a6c1cf40772bcf9b275c5fc92a63272
MD5 8efd421dbb1e0bfbd821f90121ae289d
SHA1 c606d82c7432edf7184bb4eb4eaf6e058ca1bd3a
SHA512 c29ce956cc2d4efa5585f2e1057b3020455d02ec10363aa3de87bec741810c2fbb8baaeb58f9bfb1d4518ac7f3eee49c9e328da9653d01f373594ffc4f1fed93
SSDEEP 12288:+IkFPPds2ySajT9J4kW/IRPGTJaP5nC8LKygutbOiK+UJS0xJC7cNd:EPPy4kW/uuTg1C8B1VOi9UJS0xJ3
TLSH
T14A651A37B2E2227367E274B1260D13D7BA818C3AE7628B027AFC81946F17D64D2775D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  _OceanofPDF.com_Poison_Ivy_-_Steffanie_Holmes.epub
- Size 1.4MB
- SHA256 082de9f2a950ce61f9bef636a4841f0e9a6c1cf40772bcf9b275c5fc92a63272
- MD5 8efd421dbb1e0bfbd821f90121ae289d
- SHA1 c606d82c7432edf7184bb4eb4eaf6e058ca1bd3a
- SHA512 c29ce956cc2d4efa5585f2e1057b3020455d02ec10363aa3de87bec741810c2fbb8baaeb58f9bfb1d4518ac7f3eee49c9e328da9653d01f373594ffc4f1fed93
- SSDEEP 12288:+IkFPPds2ySajT9J4kW/IRPGTJaP5nC8LKygutbOiK+UJS0xJC7cNd:EPPy4kW/uuTg1C8B1VOi9UJS0xJ3
- TLSH
  T14A651A37B2E2227367E274B1260D13D7BA818C3AE7628B027AFC81946F17D64D2775D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  META-INF/container.xml
- Size 244B
- SHA256 2ffba6b75d46c551e80e800704238fdf0b303bab480f23b1d6c9d860fc9f27ba
- MD5 4a28b4c394a98bec520da48dc6bfab82
- SHA1 f876c31dc44e32b2e9883cb32ca7fb6f0c24be24
- SHA512 1d630510a9200019363734898ec123d181eb55030b753da2cfe7ed7cc2db13ae8f5b82370feeb3c9754bbd926e5fff2f252588c0b9b471b643c103985df22d58
- TLSH
  T119D02372DFF455F2B4035C8D274C44012F71C16B9047664C30CC897E5B4455BC2811D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  content.opf
- Size 19KB
- SHA256 ac4bbd4f3ad9907bb3d2d6300dadd23f851213329c8a76a44ff1ab078d35dfec
- MD5 6073577b7bdad5ce1ff612c9db83939e
- SHA1 ccfc021ec50fbad07208a5eca7000674ff45011f
- SHA512 4a40251e3b4074d875f3f8621da8ea8fc665371141ab905b83f9ae063ca7f5911dbc759d3a64e8e67f754d58ba97601ff00233fb624222a291acee78db436c54
- SSDEEP 384:UvnhjW+KsJsWc68uc20bAydO9sQ6wK8VQa424aA+8LUec6c+EC0Jsu0qMmkGUzY3:+hjW+KsJsWc68uc20bAywWQ6wK8VQa4E
- TLSH
  T1409293C244F327C45A413E7EEEDDD74A39A255DD82825B0578BC84E62F077588223BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  cover.jpeg
- Size 80KB
- SHA256 3872df92fef9d50e80d09608e1bb233d1a7e1612cf01016180693774cda476cd
- MD5 ba765ada9529479b051a7c988d91fa89
- SHA1 0ae2cec5c030ca325e314263c79b39803c07eef8
- SHA512 73d8d4bf74898dcbd700b804d4407d6e8b6b9a12627eb99a11d5790292c0e471bdc9cf7ff9076fa9bbb07f65679b967d3ae3860b4b81d5b42bc19e501560e139
- SSDEEP 1536:ZLghT24WwLRGcWA8Q272EizodROz/AjdJy4VOmuljDuIR9+x:tmLwcWA8f2ETOzWf6/uI3k
- TLSH
  T1DC8312AACCC264C33B9662F2160F026BD613AA402CB5D47BCE189B697FD3FF451455D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  fonts/00001.ttf
- Size 88KB
- SHA256 aacb35f3c5d4b8a6f53c16619c8d51b2fc5af787dea532e4305646ad14f28c4e
- MD5 c1c92d0c804d46cb62814e7389725082
- SHA1 731b4cb1943ef27119103ea4774af7685c09b158
- SHA512 83ac6ee152168a9db5aff8441f1abae5cbed566f6d2091ab248ded11fb93b0475c7f169d174a14edbc21fac114633708c48710c3939b32e6e3c87bf51093930c
- SSDEEP 1536:xsfMvpHXHFnmi2DyXiSu2Ib2jTN3Fc7M0lWqQ4N/Limlgams:mMF1nmi2DyXi2Ib2jTg3Q4N/Limlgam
- TLSH
  T149938CD1D31ADF8FE666A73C4D11C117D5E7B920EA098B0EEE576D0DE0526C888DDB80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  images/00002.jpeg
- Size 3KB
- SHA256 abb7c8d0212f3226bc8a0fc330347669ee04aa3168dec293a979eaac0eee9c4c
- MD5 4cad48f5d30fbeef6ee4c7c4d5ea4c34
- SHA1 46774c2985c8b4cd981279ee28c8581ce1878640
- SHA512 0247c81cd8f4d6e004fa5fb78b5759d080d6029c5176de22c077ef3a8dd558198a176cff1dc430cc4974f0a2152220ce45e5a6c45822d3f63debe2d8a30afed5
- TLSH
  T19E513BD2A00B422E7C47C9B3A63D727763770687BD903D872DA00AA493317D2AE29559
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  images/00003.jpeg
- Size 13KB
- SHA256 e1b74374cb76cf9e03c228f334fe6b65bc20964de95729a9950e9c30fa53dd62
- MD5 1dcc1516d40210a7e09e006304864c31
- SHA1 f803c1477737278530db1a148579d0c22a234592
- SHA512 f8803fe43ae9e515b1b8d7e1140a8467d9c63ef3d55467e643ea63eca5e43216200b1414612c8190fe69673ce0ddc648a2ad6dc91f967158597f25ed5383946a
- SSDEEP 384:vQtS3y3vYQQeOK24LQmMMI7z7j6jilXj0lax9tnxY1H:vQg3y3JQeOh4EmXM7j6jilXjiaftnal
- TLSH
  T1AF52AE4AEE4C085BB403C269BC326FAFB03D240C6CA219AD256DDFD24E68C468DA444F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  images/00004.jpeg
- Size 106KB
- SHA256 5b5376b907ab6cff5b7b37a57218b6149374f3b294b5858c5dd35cbf39d04d94
- MD5 dec4f94854b3846b800592418bc4a466
- SHA1 71d678fd1a8ab4ba8c021d2e87b54abfd4bc41de
- SHA512 718cc11d3dc9e4a71a9de4d34efab3cf9d2b83c63771a0f0ed0d4b749d995a1c1af11b17bf9a13ec872fe2c39bbfe9cd53006793d850f1ca6b2c4493403522ae
- SSDEEP 3072:B2fz2Ak8LyJ5RQbVJV+/U4sjy08fKSqKDcSGiqQTaMH:B2fzrLK3/U79k6m0GaMH
- TLSH
  T103B312FB69307191D3CF11DDBABCC4CBA4B8CA61BD609604CB959F59292B0F188C16F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  images/svgimg0003.svg
- Size 1KB
- SHA256 5fd9830fffc875a84396adeff8e26d871613995a9ada3cc6fcb78df288ccff1d
- MD5 52c434bbe9f379ca3ec47bd24dad03ba
- SHA1 dffbbbf97e3b663178a94865201ac0b7752b3914
- SHA512 6bc07a9a812c2ad1d5cb4f64499798e7c548adc6cce29037ad1e2f01d5851e9cb2d4e542ef11681a0ff12cabccea3798391c94f4720dab963f8f90542350fde5
- TLSH
  T10A2110C043B9B2B0A987B719D73997587A7670EF0B1C59D4B228498C5B90A679E44CCC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  images/svgimg0004.svg
- Size 1KB
- SHA256 1d9d7f0b5f5f8c5129cfcb384ff31c22d75b679a295b61695a0f03d88bcb702a
- MD5 38d34f1b54de6540a8a0a3d5011a914d
- SHA1 a99b82a87d8e8edcf22bddae41972743c02db738
- SHA512 768f9289eab59fd5744ca47bcb82613c5416bba6718c98ce8d729a3eba1e6ce9b4d110d8325067235278de8447644aabeb23d0cda466225e14a2626626c628b7
- TLSH
  T106117D0BB2B894738A15839DD680D1256F2A86C356F08A80F35EAF8F4F285874E573F4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  images/svgimg0005.svg
- Size 550B
- SHA256 0a7799957c1a780d3b19a6a17cc88679c82fe48555891fc9a03ef69b12de2b1b
- MD5 97bad0c5d1946c6769213038843b4577
- SHA1 151e4f203c6ee945814b3cdf965e10638610d731
- SHA512 3bd0f4f8f9fa709c1deaa604961c37d3f6e7f9edeae07c7a0982259b626417ae858217e502d99b20713e7a886ba7271fc7f03e38d666389d8264fda56a1a9810
- TLSH
  T142F0C0CD425912CCDF1BCF74EA2C845B521274FE766018D57570EC449F48496FCD095D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  images/svgimg0006.svg
- Size 2KB
- SHA256 f5d955e68a5f3eedb265bb10129962f5880273d7be221b2e61faf0f951a68032
- MD5 05d8f2e93f33fa58c7bdd6171766f4ce
- SHA1 0b16c313cf83c2cca0ed3cababcf22a6f9c30b68
- SHA512 2bcfe261d6591040031db9f9a57486c4731ade7ac85efc4f782e0e93d5f765e58707b4daf97f83a812d2a28e2d2be389bbc531a085b3d2a48209e80f9d01219e
- TLSH
  T12241D3E85374516CA6EE873ECF1CEA8CB8AA54BD8762C2C5A22FF54C7D5ACD25C00950
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  mimetype
- Size 20B
- SHA256 e468e350d1143eb648f60c7b0bd6031101ec0544a361ca74ecef256ac901f48b
- MD5 4154e1f4f9c0e002cc44aae97103ebe2
- SHA1 8cae3584d360f721c4dd0ca38a4f2d8b36da74c7
- SHA512 f6f5ae4728dbf0f0f6b5548440f2c4fd3365e0437471102f55113bbd25f0e26cbc450981cdc5c89e947535ccbfb72f4c1ece9758f9c88c612b8cde8fd3553155
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25 behavioral26
- Target
  page_styles.css
- Size 185B
- SHA256 6a7b33a1a01bfefe9688ef26d1130b4cbbf96a640ca411b2c07a383872134590
- MD5 722ca51d8aa38b7ccffb50199b4381f5
- SHA1 c0784a17a55c4ae73f539086c89c0ee9d6eee54e
- SHA512 59028f0573e1b273b7c2862d5cc6ba5ecfeb9cf3fc7d43449c9580cf09394fa463abf07cc77655c3f35fbbf6b9182cb99a25fe72f37726dd2d40cbb1d502061b
- TLSH
  T1AAC0801404575141F5432C4D735F2428544F2447108AC4517EE13904CFD61655343B5E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  stylesheet.css
- Size 15KB
- SHA256 863f5722d8385a3f0316e52ee7cc24d99775f8a53e6e4080671e94321cfb5652
- MD5 f030a569cf01be4e14b9317337f19d72
- SHA1 983bc748d1d777908d087915239b8a6d2b3b42e2
- SHA512 c47ebf6cdaa1e275a621973b9d846b7dad88e9b4dd4e5badd0d15acbc44d1c9bf860af3f04f61cbd0c5b2f3e5fd6d23d207eb4ba5e9043230fe55f15908ff31b
- SSDEEP 192:44RwZDBz5QPjMHgvrmDywKHhPUjmZDkMgQFyUr6Ssyqd+7E3WUQUGZeatS4VQiYe:sDJ0MIDuQ
- TLSH
  T10B62AD4E05230240EE679C793FDE2724B56084335B4BD8B1BD85A604CF4FA66D2DAB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral29 behavioral30
- Target
  text/part0000_split_000.html
- Size 975B
- SHA256 9fe6a513015b65f4b127bf1410fbc762b7618039e212d8cd99d51b5cf7b7cde9
- MD5 929f4cb7d0846def4411c5720821b77e
- SHA1 6aced8b8456b703d451389cc217e1c4d1f3d2a6d
- SHA512 916b157c821075bf7898fa93391b150695f692bd12e410aa6a0951dae178221639460187e0b3d3b56515265416711aa5aabe2f3671b783b2fbbdbc7e31d9e83e
- TLSH
  T1FF111C2BD0B81501B38196E030F0331E5C819282EAFA2884B2645EA4EBCDED9D1DB1AD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32