d65ff2a5702029e153569704edefb8feb306aba93582bea3cb47deeb4d8c0f06

Sharing

Copy URL Twitter E-mail

General

Target
emax.zip
Size 7.3MB
Sample261015-pbt4eacv9t
SHA256 d65ff2a5702029e153569704edefb8feb306aba93582bea3cb47deeb4d8c0f06
MD5 16709386af97ccf2cf1ac101d066f8c1
SHA1 9c0ccd3fbbe318d49fa36e013d898234e6fabee6
SHA512 e6117aa9c3dc3f9897b2ac6ff0afe42e12e8f3145497819dd95d90677acd968ffe1d7b0d452b69fbf0c825655722a9476b2dab4d93fbf971d1b5bcdc89ade842
SSDEEP 196608:LuuxOZX5WMsGA6ZkHEBvZ3KQCK5gWxBKkz/JHAY7O4D:vsZXtsGApEBvZ9CkEW/NAY7DD
TLSH
T15776337C020E82A6C54FE4B7561E12E781CE1BB697A9D3FE367493D096035C4183F6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  emax/archivos/aviso/Aviso-de-privacidad-E-MAX.pdf
- Size 402KB
- SHA256 187518bf5e3ef7a813e3815c32aa3e7dfb6817f2388b79231880dccd29fd6030
- MD5 1baf34c86a3fe944665cb7b6b89f4f71
- SHA1 8e8ecaa2748e8abff2f7b10fb3b019908157d017
- SHA512 671d700e26563a30d88b1a2ca0ab0d9d3599933d2d49b3563f62a86519981a8a2462a47d89ee469d32d433703470f449673c2204b27297e077adb8e778331ff0
- SSDEEP 12288:OcyfC3KHVx3Yg1x+qP8K+a0EJYxJLs9+Qntn:xyf0KHf3Yg10w0MwJLJSN
- TLSH
  T1B69412584A8F6D4CD9AECA13FE551E10F74CB12660DBC1B00ECC90AE43E57AFD62A4E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  emax/archivos/favicon/safari-pinned-tab.svg
- Size 1KB
- SHA256 4d012599157f77447eefc7e427cc3f85560210c7a464804435dda8938677e5ab
- MD5 0cf553738c3c0cc7865c0bac470f76c2
- SHA1 653040aced6dfcae7016b8b3d488fa4ca4870fdf
- SHA512 d15ff7d81b4dcbfc366a6096fd032ad3d14f25beb846f4dee20613c5f2da4145ac31eef390bc3aec4d2e17a9254b786b7053e490cfff0a0b65049c8944a892f5
- TLSH
  T12E2130B49840993AE9CD07C0CB19FECC02BBF38B42E038969AD538150C10F72ADF9609
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  emax/archivos/iconos-emax/demo.html
- Size 7KB
- SHA256 2299e121c1795462a9487173d76bd581ad4cd348f987c555578e062a7ec39939
- MD5 f6788e2b0d9207eef64601d705f1019d
- SHA1 06e1c5a9a5e8d9b59bbe6e105a3dee7dd7a1582c
- SHA512 3d55425258e96a6b1b22d88db2805d3974dec44517f6f454ca554a7e367fb9c431c41af7fe9a9f50c900adf42719dc5ae374b5b7ba6d54a47df8db469413014d
- SSDEEP 192:Rnmjat4+MVmXhLqG7kr8LwNXlyaKMEpvpEmEjEnlUEP/EME9ESEJE4y:mJawj+fm+Uit0hIQ
- TLSH
  T1DBF1659146F11533A22354E937999B22779C8017ED0EDC60FAED2B888FD9C41B46376D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  emax/archivos/iconos-emax/font/e-maxicons.svg
- Size 18KB
- SHA256 4489410ab7eefa4023b4f4ec92c849c9804ca168f82fa5e7a693c94c522ab7e1
- MD5 cfa5684076f2fd73293c32cb58b92a32
- SHA1 ff42d11d7db793422c6d97619d70dd987c07ccf9
- SHA512 01b3f33cbd11efb6141351b526d9ed6596c878209e47dd177c326b2cde63de17d265670454d45fbcb778c837dcd7e4b4c95819e90f18b2575f97ab85974b6612
- SSDEEP 384:T+ylF4Om0YYtV1ht6lGDPlgx867yDB6MVVhJZ5LkdhNyI:Ti2Ym1r6lGDyK6UhhJXLCNH
- TLSH
  T1CF821225F9BD708EA76E12C04A7E42979B2DF37B121A452711ECF5F04A0B92BBB47D40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  emax/assets/fonts/fontawesome-webfont.svg
- Size 347KB
- SHA256 7414288c272f6cc10304aa18e89bf24fb30f40afd644623f425c2c3d71fbe06a
- MD5 76a4f23c6be74fd309e0d0fd2c27a5de
- SHA1 2b3c8ba7008cc014d8fb37abc6f9f49aeda83824
- SHA512 b0bde727e026bef3051ed0c98d3b315a7d72a421036628490b3a11c56276bc9d4c8c8c8d608463609550bb94eab7cb5f3216d93682053657abe1f7e01b287f3e
- SSDEEP 3072:Unw+ubvqCDOzA5vK+jRwXxSbs3cMrNKyOATzr3Omq2OE+unSGwd:VNlFyGL
- TLSH
  T11374A568F95107B9CBDC42C09A7E0D94632D916E18753E68467E98F05C0AB2E4FCFEC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  emax/assets/fonts/glyphicons-halflings-regular.svg
- Size 106KB
- SHA256 0688333129cbe4acc8baea3b35f8015287078f3035b9f56768389dd9cf8a0d91
- MD5 08eda92397aee9e52a40d431c3a28e5c
- SHA1 087eb3d39f98f83c869304eb01e5e5d70f4a236c
- SHA512 9c1d315c71d879347b57a58acb30c10728247665d387bc3f4440338322fa27acee38838096beceba7a510cbf2ad56a3c53807ac075a970216a634dea11ccfa56
- SSDEEP 3072:jY+spjSP0yD4zOPqGGUG0kSnouoxvKDHkPooe4Pqo0CjmFIudsqi/CWEi:kRjSP3D4wlG0kSnouoxvKQPooe4Pqo0W
- TLSH
  T1A9B30F1CE9940B709BDDC3A25B75AE54231C418D72303CD04AB9E5E0B99BF694F8E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  emax/assets/fonts/lightgallery/lg.svg
- Size 3KB
- SHA256 0761c1a990fc3da2fbbb50ec72029b1cd80f597bfe8a49130a4eade1a4fbb74d
- MD5 96a0a0319d4d5541d97d1448807d32c5
- SHA1 e57acf2cd089560d08642bbced97c6457b763430
- SHA512 85a17cd8cc11fb1bb532dea3e622880418c129a878b326fcc42da9dd931b4e1383506950ea5e10a0604e7a75e54c907c84146921f6cc3563d846c20623d2d60c
- TLSH
  T18581234CF3519EB4978F8F85A9DC4E50003CBB53318B796C9AAC3360A6407ED2B265E7
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  emax/assets/fonts/slick/slick.svg
- Size 2KB
- SHA256 12459f221a0b787bf1eaebf2e4c48fca2bd9f8493f71256c3043e7a0c7e932f6
- MD5 f97e3bbf73254b0112091d0192f17aec
- SHA1 17f63c6f6131389462ba3d814b7ddf83344705f9
- SHA512 4d8792f817feb2b6d1bee560717e2972a1cdd9c5734f8f2fae54a589ea39352bd0a393192c04adcaf763c0e06f3c3ee2d28a06ace7608552bbe080c0387a0c05
- TLSH
  T12841E010DAF97885FA8543C6536D01819A3C67429165135FD2ACEFF37E1C246F72BAC8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  emax/assets/form/js/contact-form.js
- Size 3KB
- SHA256 754d7ad0c853b0b299597310226b4e4123e08a14dc24c70994342fb5349128f9
- MD5 29b3b2cbdfd55634942197da18ecaa4a
- SHA1 04f82a2882c755444a66401a6fe875d005ef1eb4
- SHA512 d4c63e4c8753c1218eac340e4d5dadf28475ba07af290be0e70cfe7540b3fa0339eedfe7d9f5e83d5539714ceadca48dbc1f9b50ed0cca3131f2770c1269c684
- TLSH
  T1C961AB2D7AF758B1043370BD9AFF8409A6195853910ACE04B98D61E5AF88964AF20BED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  emax/assets/form/send.php
- Size 1KB
- SHA256 b651ef5cec604d2aab8f9ab7204e2e8436981eff8b26958d4c0b8ae7fed2840f
- MD5 48082633ad6a2a82de6616318cbf3907
- SHA1 743bc6894891dd0d5f974f73e100adf04e8eed37
- SHA512 eefcbf6cc3fa9ce3d59104a496c1cb7685a7e972e4fae6029701dfa5edd13f4a263e37ecb71b3740f41e93e6f211428a35be42f7efac856e73deb8ba8f200f2e
- TLSH
  T14C215341AC6CEB46FD1134ECA795F907EC02E0002918BA71E953759408CCDAFBEB42BA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  emax/assets/js/boilerplate.min.js
- Size 237KB
- SHA256 30a7cc6c862b0675a23e87e2ff2b64ad8240922ed733324574d865fe5bce2cab
- MD5 236c1e2b925178026a3a5756bea0509e
- SHA1 e6d3f6e0a8fdb5b2b77a04c350d38acf0011b81f
- SHA512 722200421f2d03669ffb23e1995642f601201809147e85486e6a78ab718fe38bc1f599cd6ff03d29efbc8319cbf2cc7b9cac0b6f3bb663193224cfdca48c54b2
- SSDEEP 3072:6/Kj0yRCKEXIVx1Pk75CoUNx8EN0CekkrlP3txS:6ij0yRCKE4C51nG49xS
- TLSH
  T1D6344CCDB281317147EB20F5505F510EB337A96CA80A8064B1A4D9E67C7CD49A2BBFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  emax/assets/js/disrupt.min.js
- Size 260KB
- SHA256 72aca579114534f0527106743e525644b8646620f616448b3435a0509e0240a5
- MD5 64a1cbb3a10e00f851f072bfd026ec49
- SHA1 a13f92e99233c95bbf301f6ac85dfecc9f34079d
- SHA512 bd57b6e997bf271aa88eb088b9f1d967fe6f6aeb43d304af1450fb57385c70f0dfdf6b41a84324377364c9d37949cdfee46a2b8574b3898987c6598aa38114be
- SSDEEP 3072:8LOAOWIBlpPshxmhDyDYCCHOBn7vTpY4oBZmO+WSjNH/:UZIBDUhxmO1CAUqxNf
- TLSH
  T1F8443B88B280317247EB20F5505F450EB336696DB40680A4F2B9D9E67C7CD49A1BBFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  emax/assets/js/es5-shim.min.js
- Size 17KB
- SHA256 c4242001d22f6a186deb334a84335af0717f5c1f7e2793f123a8a415c99911aa
- MD5 4fc289355240de9356ed6f8fb55e203a
- SHA1 c305e4857558b957819591699bb04008caf9782f
- SHA512 d80c460d71aee6735baba7292469e9dc2cd907ca356194dc7e2d448d49f0d455ce6885041a5b0f865e44e10d584ee5da3610c7bec49b4ef52c05ed47f2f43ec0
- SSDEEP 384:c84cyXSAgJsgw6FhFeEpX7IQmGhVKsfFiK+:edq+WbDN7+
- TLSH
  T1388273C473D1B0B2D7E72A60042F7506F139ADA56CCDE464E294F5B178B0E46826BF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  emax/assets/js/html5shiv.min.js
- Size 2KB
- SHA256 3d458f51bc559f7855995e21fd2225c32f660d603970267b376c237bec08232f
- MD5 ba846cb704dbfbc5f1b34ce0e3127924
- SHA1 e19815b1ffab80696890ca4cbaf4d3918d13352c
- SHA512 82195099b368b0b247f339ccb72ffa4dddfdf683e5d97619128aa20e731f7a75ae549cc6492995843a146d8d09245791f4025ec1089d0bd42219660ce845c6eb
- TLSH
  T1B751A8857062714A8B2F11AB917F970FF5E452A6D8580060D0E9C87CF930DF8C2BBF65
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  emax/assets/js/main.js
- Size 17KB
- SHA256 2a5ede19350fbcc589224c413b81cb1b1685d4bfa03907d45ea91f1f64637377
- MD5 7c159927b9838191f2158dd97acf6096
- SHA1 a20c2eab061f40b76dbcd36872501f03196c0dc4
- SHA512 b9379cb0a9ed6c757f6dd521e6258cc3e46c25559464e581d5599340da88bb5938d8f2991696edd05d7c8322f515de0c9a88692efffbbdb7272e709c9ce3f84b
- SSDEEP 192:PmEk9yaxm650Clf2C5n1Qox/Jz+6uy3bCv7rFvCNcIfXT1CzLdLN9o1gxgR0q6Eg:Pd0n5n1tqFY71CzdEyDZLB/mHI
- TLSH
  T15D82554979F25027147BB03B4BFF60446739A02BC64DCA68B85E2B840F8116C757ABEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  emax/assets/js/plugins/datetime-picker/datetime-picker.min.js
- Size 28KB
- SHA256 f4e96c22cdd8763891e3ecf835d4ab92043b96981246554d4ddff286b9944edd
- MD5 4f7373519270e0e659d2daf41c65bb78
- SHA1 48ae7cf98268b659e68a68961e35bbd953b3d2f1
- SHA512 807212ab9fc434af4be5add8a6d7dc1f9edd904aba3397a9b3ebc2226c645d4bd345696e523d05974757e771eead6e1ee5dba9469927cc6ba62592d16da38fa1
- SSDEEP 768:fnlNhE9EwHKwmJqtG4oQstbHpBtxI2QuXieBloVAJ9Km062:fnrjwH8JqtqLB7cuXrQaJ9505
- TLSH
  T182D2A5DD3095796142BB81B4812B1303A733D46A9C89883CBD6CD9D6697DD0A32BDFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32