Extracted

• • Target
    RE-87397858931181030691.pdf.lnk
  • Size 3KB
  • SHA256 4d2ad5f40c952101cd28316b10d496bed8ee8a500d5e27fcae4f8502be709039
  • MD5 40f6e60703a1bf095e309baa6145d497
  • SHA1 6616b8b74144b84fdf533d28ad53f602ebd17b52
  • SHA512 bdd9d82e2ebed3391a1680b44f0e508b301ca983acd21e21749fad9863052f861fb75110383e2a5e91e7caf12c66fd48d19ae59524e2ca2769df19b32197534e
  • TLSH
    T1D961AC5136E94324D2F36F36D87EEA045635B845DD67CF1E0185C0CD2896610D83AF3A
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2
• • Target
    _
  • Size 10KB
  • SHA256 47aaf224157a5d7f2299ae509e1f60e53db3aec73c12e92e0c69f4857a1d90f1
  • MD5 4fd62280887227840a29d1f5950292e8
  • SHA1 1a0b1be245b5595230063a2d7f35268b5a147658
  • SHA512 dea81ba8f79b7deec1bb4104866eb5d9dab012f788a885e8e0d32a706f403e8ceb71d63478e4b23eba24ec4c6efc616667170c9f19be9340822667d34cfb72d9
  • SSDEEP 192:I+r5aqp5C1guXrZFPtn62UDwEnMImYgFHgBOHmHgxySDbA6gxySHgvlcghogwTu:7r5aqp5C1gubZFPtn6VDw5YgFHgBOHmg
  • TLSH
    T16E22FFF731044D21CAADA29AB7741093F3E6C75B47104AC5B06B40FEA85D7BED2D93A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    settings.ini
  • Size 10KB
  • SHA256 6ad8a6a4c8d3cb1613696a021e17229bbe5376c405162c990f2791b5f70e9ed8
  • MD5 4c8fecc4be2a282e444d8d5007dfb92c
  • SHA1 c308558a5d92210b8d30f33481f0b9ca3305fd4a
  • SHA512 7a1e801cd1b2b352c318df750540a69bfb1aaa19dee6bbd81f63548ca38d429e38de623c7fb8a2d6653d618eb55d48dbe0ec74ef10bd72c28834633e96819922
  • SSDEEP 192:p+r5aqp5C1guXrZFPtn62UDwEnMImYgFHgBOHmHgxySDbA6gxySHgvlcghogwTN:Yr5aqp5C1gubZFPtn6VDw5YgFHgBOHmT
  • TLSH
    T18D22EEF731044D21CAADA18AB7741093F3E6D75B4B104AC5B06B40FEA85D7BED2D93A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalationdefense_evasiondonutloadervioletwormloaderworm

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral5behavioral6