Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 12:50
Behavioral task
behavioral1
Sample
mdview.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
mdview.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
pdfium.dll
Resource
win10v2004-20260911-en
3 signatures
150 seconds
General
- Target mdview.exe
- Size 998KB
- Sample261102-p21c4sfb55
- SHA256 7054061ccb21494e7875ade528e775d7448622377e417f6a9e9840f5100291fd
- MD5 d725c2ceecd98397867e03a1da6a6295
- SHA1 3b096bd9d370b36e245cf0bfc1f5bdc000366ab9
- SHA512 20c43c4a09f2345afdc925e6a4e292aca7f53f271425def5c40dcba9f00cd94e9de9674c197b6a2c7af5512f4896a70ede2c7b15e8437a32b093431d8599816a
- SSDEEP 24576:xfg3NV2uuXpeGi5p5BShYIr/Z22RobvPf:xfJv8GkhIkEobvP
- TLSH T12E25232A1AB506D0D92317B2F2E6C2317BEB93951F4B825794D42ACEBE70D505B8F0F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1888-0-0x0000000000400000-0x00000000007D4000-memory.dmp upx behavioral2/memory/1888-1-0x0000000000400000-0x00000000007D4000-memory.dmp upx behavioral2/memory/1888-2-0x0000000000400000-0x00000000007D4000-memory.dmp upx behavioral2/memory/1888-3-0x0000000000400000-0x00000000007D4000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdview.exe