Extracted

• • Target
    PDF_ADDLGJ_20260922122443.VHDX
  • Size 36.0MB
  • SHA256 166221a31819aee46b92facc60d11e99deebca9e610adde65709c6b91344e1b0
  • MD5 35afedeb928613276c540deb76a6aa69
  • SHA1 8991e06a98cf1a92f16b2e17ab58a44343607c72
  • SHA512 460aa2c0eb4952a130338521b65245f305e7c33de793f279c2546667d9c302e0a2bc2901c5d7ad83abfe9720f590ff807e234769ff5dda4e52a408293d8ff7a8
  • SSDEEP 12288:wUDuH/c82GQ8y3CtcoRv6ilTMgTMV3+Ah4:wbH/v2G5MViTw4
  • TLSH
    T1D9875C52BAC08922D1EE623585EED7367375FE212B13038BA646B3397E723D01D78917
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionratspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • DCAgent remote management tool

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2