Extracted

• • Target
    RE-5549445.pdf.lnk
  • Size 2KB
  • SHA256 cabc4b659ebef9e1ffb1f14d6f284704d40e0f66678cc4611b1679d7c09edbdd
  • MD5 e50c4023c766cc9a33c492d51290722a
  • SHA1 f943af248f4d2b45b34ea273399effc5c25e9e6a
  • SHA512 dc5506d57ecf543ce80e66bf8d82185f96cd3491ee3e281272ee08383d38420433db87a00fd14cbbdd4f5731ac24e3a2e5f22674b29fb4c2bb87e5cfb39fbe93
  • TLSH
    T1AD51FE512BD9432AD6F35E374869FB049335B881DA67CF6E4182C5CD385A600D839F7E
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2
• • Target
    _
  • Size 11KB
  • SHA256 4e7ec5db89ae6fd9fc4dccbf79a8f90257a2e96b4eae4a840a2d846d87cbf0ad
  • MD5 d0bd40f0eafb107556920ab28eabb36c
  • SHA1 e93f9428d96076c962a4e8b0a0b7a2ad31b1c9ec
  • SHA512 14f611d79a9514f44a9cac90036d0914768bcb818aab53d7865516ff8df2c038435063f5e8c2c8e74c2344730f0c6d4d1581f843a1be84acd1c1ec9e728586d7
  • SSDEEP 192:5r1y4PnPXkFxTAhoZZBBVNDwEnLmOTIlTOOImIgxySIbPFgxySfT6PY5TWFTFsy:5r1y4Pn8FxTAhoZZBBvDwxOTIlTOOIm4
  • TLSH
    T18532236731484D31CAF9E254F6341482F76AD39B474099EAB04980FDAC7D7BEC39D2A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    config.ini
  • Size 10KB
  • SHA256 f32b25698fce9b37e4ec0ace0aa13b8babba7b523f898e174a6c90bf8d8e5733
  • MD5 9b88d89ac1ae0037cd0a152ae2f1f42f
  • SHA1 74d784175f39c156608ea4d7532f3e484f588995
  • SHA512 fb8eb4218bfab4938baa239a15127cab537f98acdcbd145d0f2cd4437aa0eae442d642d857fbaf53ebb34155184509e18b71fcb0efe86625dddd2dc5a7210a0b
  • SSDEEP 192:Ir1y4PnPXkFxTAhoZZBBVNDwEnLmOTIlTOOImIgxySIbPFgxySfT6PY5TWFTFsA:Ir1y4Pn8FxTAhoZZBBvDwxOTIlTOOImq
  • TLSH
    T11A32146731484D21DAF9E284F6341482F35AD39B474099EEB04980FDAC7D7BEC39D2A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionpersistenceprivilege_escalationspywarecollectiondefense_evasiondonutloadervioletwormloaderworm

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral5behavioral6