Extracted

• • Target
    New_Purchase_Order_PO-2025-01001481_pdf.exe
  • Size 601KB
  • SHA256 b39eaec9267ce32916823eba57c71fbe321b9648cc8f50ee6d1a171800daa1e4
  • MD5 e6b2cc822ad480918e97070a62643b90
  • SHA1 bac01f415ab5e6e43b1fd2a6b3713bf7adb1ab1e
  • SHA512 4fef18ab040665cc816c570b1adf1e9bd42bf378db5d2b2aa73bc286681bd4109a823bb44f84f763279356c443d8267dcd1afa868a7a32524d62ea68545d5da3
  • SSDEEP 12288:OMweUzNb/QMy+P1NyRJwonnb1UB57NlBPrjkGWl:OMweUzNb/QMTtNyRJwEnh07RzjBY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoverydownloaderguloaderphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer payload

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
  • MD5 564bb0373067e1785cba7e4c24aab4bf
  • SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
  • SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
  • SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
  • MD5 48f3e7860e1de2b4e63ec744a5e9582a
  • SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
  • SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
  • SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6