%5BMS-KILE%5D[.]pdf

Sharing

Copy URL Twitter E-mail

General

Target
%5BMS-KILE%5D.pdf
Size 2.5MB
Sample261110-pnx1tsay2x
SHA256 36f506bb20abc15c3748c6ad00714a0aadc3617c410036ee4e186efa94a524da
MD5 8157b604f712552b4f697cbf525e344d
SHA1 7972d0105c20781ec8a798e05ac60a3f3f8b7736
SHA512 40e621ded7c552e54375c7ad4771219fd8a302164f61ec7c6d72a9e797c81e6c88ece4ad5dabe340ea862810a45e1ed420af89d3a8b34f680af858a3e00130fb
SSDEEP 49152:DbvVi8pXF36ul8W/+v2TVvZ2pD84RRvF4jJJlCSx+nNVckfxRQoRkL9B9EGiY:DbvN6uDEW
TLSH
T121C55350A8824ECDD8D7CAC79F6594277E2CF22679CE84C5026FCF13A502F8F5687296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
sample	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link
One or more email addresses in PDF identified
Detects presence of email addresses in PDF files.
pdf

File Explorer

%5BMS-KILE%5D.pdf

.pdf 2.5MB

%5BMS-KILE%5D.pdf

SHA256 36f506bb20abc15c3748c6ad00714a0aadc3617c410036ee4e186efa94a524da
MD5 8157b604f712552b4f697cbf525e344d
SHA1 7972d0105c20781ec8a798e05ac60a3f3f8b7736
SHA512 40e621ded7c552e54375c7ad4771219fd8a302164f61ec7c6d72a9e797c81e6c88ece4ad5dabe340ea862810a45e1ed420af89d3a8b34f680af858a3e00130fb
SSDEEP 49152:DbvVi8pXF36ul8W/+v2TVvZ2pD84RRvF4jJJlCSx+nNVckfxRQoRkL9B9EGiY:DbvN6uDEW
TLSH
T121C55350A8824ECDD8D7CAC79F6594277E2CF22679CE84C5026FCF13A502F8F5687296
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

Extracted URLs

file http://AssignedPolicy.ms
file http://AssignedPolicy.msDS-ComputerAuthNPolicy.ms
file http://AssignedPolicy.msDS-ServiceAuthNPolicy.ms
file http://AssignedPolicy.msDS-UserAuthNPolicy.ms
file http://AssignedSilo.ms
file http://AssignedSilo.msDS-ComputerAuthNPolicy.ms
file http://AssignedSilo.msDS-ServiceAuthNPolicy.ms
file http://AssignedSilo.msDS-UserAuthNPolicy.ms
file http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf
file http://dc-01.fabrikam.com
file http://dc-01.fabrikam.com/fabrikam.com
file http://example.com
file http://fabrikam.com
file http://hostname.domain.name
file http://ient.domain.com
file http://microsoft.com
file http://tools.ietf.org/internet-drafts/draft-ietf-krb-wg-kerberos-referrals-11
file http://web.mit.edu/kerberos/www/dialogue.html
file http://windows.example.com
file http://www.ietf.org/rfc/rfc1510.txt
file http://www.ietf.org/rfc/rfc2222.txt
file http://www.ietf.org/rfc/rfc2744.txt
file http://www.ietf.org/rfc/rfc3961.txt
file http://www.ietf.org/rfc/rfc3962.txt
file http://www.ietf.org/rfc/rfc4121.txt
file http://www.ietf.org/rfc/rfc4556.txt
file http://www.ietf.org/rfc/rfc4757.txt
file http://www.ietf.org/rfc/rfc5349.txt
file http://www.ietf.org/rfc/rfc6113.txt
file http://www.itu.int/rec/T-REC-X.680/en
file http://www.itu.int/rec/T-REC-X.690/en
file http://www.microsoft.com/trademarks.
file http://www.rfc-editor.org/rfc/rfc1964.txt
file http://www.rfc-editor.org/rfc/rfc2119.txt
file http://www.rfc-editor.org/rfc/rfc2279.txt
file http://www.rfc-editor.org/rfc/rfc2396.txt
file http://www.rfc-editor.org/rfc/rfc2743.txt
file http://www.unicode.org
file https://go.microsoft.com/fwlink/?LinkId=107082
file https://go.microsoft.com/fwlink/?LinkId=125716
file https://go.microsoft.com/fwlink/?LinkId=127732
file https://go.microsoft.com/fwlink/?LinkId=129652
file https://go.microsoft.com/fwlink/?LinkId=139781
file https://go.microsoft.com/fwlink/?LinkId=214445
file https://go.microsoft.com/fwlink/?LinkId=214448
file https://go.microsoft.com/fwlink/?LinkId=226316
file https://go.microsoft.com/fwlink/?LinkId=89824
file https://go.microsoft.com/fwlink/?LinkId=89846
file https://go.microsoft.com/fwlink/?LinkId=89866
file https://go.microsoft.com/fwlink/?LinkId=89872
file https://go.microsoft.com/fwlink/?LinkId=90264
file https://go.microsoft.com/fwlink/?LinkId=90268
file https://go.microsoft.com/fwlink/?LinkId=90279
file https://go.microsoft.com/fwlink/?LinkId=90304
file https://go.microsoft.com/fwlink/?LinkId=90317
file https://go.microsoft.com/fwlink/?LinkId=90322
file https://go.microsoft.com/fwlink/?LinkId=90331
file https://go.microsoft.com/fwlink/?LinkId=90339
file https://go.microsoft.com/fwlink/?LinkId=90378
file https://go.microsoft.com/fwlink/?LinkId=90444
file https://go.microsoft.com/fwlink/?LinkId=90450
file https://go.microsoft.com/fwlink/?LinkId=90451
file https://go.microsoft.com/fwlink/?LinkId=90458
file https://go.microsoft.com/fwlink/?LinkId=90459
file https://go.microsoft.com/fwlink/?LinkId=90482
file https://go.microsoft.com/fwlink/?LinkId=90488
file https://go.microsoft.com/fwlink/?LinkId=90532
file https://go.microsoft.com/fwlink/?LinkId=90550
file https://go.microsoft.com/fwlink/?LinkId=90593
file https://go.microsoft.com/fwlink/?LinkId=90594
file https://go.microsoft.com/fwlink/?linkid=2095478
file https://go.microsoft.com/fwlink/?linkid=2102428
file https://go.microsoft.com/fwlink/?linkid=850906
file https://msdn.microsoft.com/en-us/openspecifications/dn750984
file https://support.microsoft.com/en-us/help/4490425/updates-to-tgt-delegation-across-incoming-trusts-in-windows-server
file https://tools.ietf.org/html/draft-swift-win2k-krb-user2user-03
file https://tools.ietf.org/html/rfc6806.html
file https://www.microsoft.com/trademarks
file https://www.rfc-editor.org/rfc/rfc4120.txt
file https://www2.opengroup.org/ogsys/catalog/c706
file mailto:[email protected]
file mailto:[email protected]
Show all