Malicious
c3c3fc553049fafd94dd87113842c346
ZIP Archive
MD5: c3c3fc553049fafd94dd87113842c346
Size: 24.71 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
24.71 MB · 24,709,150 B
First seen
2026-09-04 16:00 · one month ago
Last seen
2026-09-04 16:00 · one month ago
Last analysis
2026-09-04 16:01 · one month ago
Hashes
MD5
c3c3fc553049fafd94dd87113842c346
Sha1
8a4cde7491abeb1c3c4a22d5ebf88609f4584180
Sha256
ea63dec0ee955b1f7fab073023b18d87c6b783784e9a5d994434f1b91c5eb80e
Sha384
567a8eacfe62dd364010a0d3f18e16a695e8c64d9ee1dc73544e8bdf957e82b0b05e1e104e04abef465bcb6dc391fec7
Sha512
fbfafe72f3b1cc63454d29c1acd58335fd0c2b3e4cdab2a698f9ccb349d49602c292dbd59dd3c782895d379a500470cc44414905d596ca6a6a69d2d0314ec6dd
SSDeep
393216:1z1iw2IvWlYLhVCdC7HsAW4NqIN7ihVA7VfBfLqqrOjVR71FZ2nsWlYLfVCdC7dS:51iMWiLGwrNfivALzqqrOr71FXWiL4Z
TLSH
E947330619E64FD1D95D893590EB2703321DEF0B5053A34E87B8D22B3EB36F89F18699
3 malicious · 635 files
ZIPc3c3fc553049fafd94dd87113842c346T1059.005 · T1059.007CVE-2019-9674
BINlogging
BINbin
EXEdiskpl.exe
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0065
BINID:1033
BINdiskpl.exe.manifest
FLXdiskpl.flx
ICOdiskpl.ico
BINimageformats
DLLqgif4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqjpeg4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqmng4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqsvg4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqtiff4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibmng.dll
Structure
DLLlibmon.dll
Structure
DLLlibpal.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibspg.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
HTMlibspp.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLQtCore4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLQtGui4.dllT1059.007
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEsppinst.exe
Structure
EXEsppshex.exe
Structure
PYCconfig.pyc
PYChandlers.pyc
PYC__init__.pyc
DLLlibffi-8.dll
Structure
P7B[Authenticode]_b7239277.p7b
DLLlibssl-3.dll
Structure
P7B[Authenticode]_03ef52d6.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLpython315.dll
Structure
BINOverlay_2939085c.bin
BINResources
BINRT_CURSOR
BINID:0001
BINID:0
BINRT_BITMAP
BINID:0000
BINID:0
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
BINID:0
BINID:0009
BINID:0
BINID:000A
BINID:0
BINID:000B
BINID:0
BINID:000C
BINID:0
BINID:000D
BINID:0
BINID:000E
BINID:0
BINID:000F
BINID:0
BINID:0010
BINID:0
BINID:0011
BINID:0
BINID:0012
BINID:0
BINID:0013
BINID:0
BINID:0014
BINID:0
BINID:0015
BINID:0
BINID:0016
BINID:0
BINID:0017
BINID:0
BINID:0018
BINID:0
BINRT_GROUP_CURSOR2
BINID:0000
BINID:0
BINRT_GROUP_CURSOR4
BINID:0000
BINID:0
BINRT_MANIFEST
BINID:0002
BINID:1033
EXESet_up.exe
Structure
P7B[Authenticode]_8e38f8be.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLsqlite3.dll
Structure
P7B[Authenticode]_ba5c5cd4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLttdrecord.dll
Structure
P7B[Authenticode]_d4cdd72e.p7b
BINResources
BINRT_STRING
BINID:0007
BINID:1033
BINRT_RCDATA
BINID:0066
BINID:1033
BINRT_MESSAGETABLE
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_71d478a4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINemail
RSTarchitecture.rst
PYCbase64mime.pyc
PYCcharset.pyc
PYCcontentmanager.pyc
BINdoc
PDFdiskpulse_manual.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTPage #12
TXTPage #13
TXTPage #14
TXTPage #15
TXTPage #16
TXTPage #17
TXTPage #18
TXTPage #19
TXTPage #20
TXTPage #21
TXTPage #22
TXTPage #23
TXTPage #24
TXTPage #25
TXTPage #26
TXTPage #27
TXTPage #28
TXTPage #29
TXTPage #30
TXTPage #31
TXTPage #32
TXTPage #33
TXTPage #34
TXTPage #35
TXTPage #36
TXTPage #37
TXTPage #38
TXTPage #39
TXTPage #40
TXTPage #41
TXTPage #42
TXTPage #43
TXTPage #44
TXTPage #45
TXTPage #46
TXTPage #47
TXTPage #48
TXTPage #49
TXTPage #50
TXTPage #51
TXTPage #52
TXTPage #53
TXTPage #54
TXTPage #55
TXTPage #56
TXTPage #57
TXTPage #58
TXTPage #59
TXTPage #60
TXTPage #61
TXTPage #62
TXTPage #63
TXTPage #64
TXTPage #65
TXTPage #66
TXTPage #67
TXTPage #68
TXTPage #69
TXTPage #70
TXTPage #71
TXTPage #72
TXTPage #73
TXTPage #74
TXTPage #75
TXTPage #76
TXTPage #77
TXTPage #78
TXTPage #79
BIN#Stream obj 15 0
BIN#Stream obj 533 0
BIN#Stream obj 537 0
BIN#Stream obj 534 0
BIN#Stream obj 538 0
BIN#Stream obj 535 0
BIN#Stream obj 539 0
BIN#Stream obj 536 0
BIN#Stream obj 540 0
BIN#Stream obj 5 0
BIN#Stream obj 19 0
BIN#Stream obj 28 0
BIN#Stream obj 27 0
BIN#Stream obj 24 0
BIN#Stream obj 35 0
BIN#Stream obj 34 0
BIN#Stream obj 32 0
BIN#Stream obj 39 0
BIN#Stream obj 46 0
BIN#Stream obj 45 0
BIN#Stream obj 43 0
BIN#Stream obj 52 0
BIN#Stream obj 50 0
BIN#Stream obj 59 0
BIN#Stream obj 58 0
BIN#Stream obj 56 0
BIN#Stream obj 65 0
BIN#Stream obj 63 0
BIN#Stream obj 73 0
BIN#Stream obj 72 0
BIN#Stream obj 71 0
BIN#Stream obj 69 0
BIN#Stream obj 80 0
BIN#Stream obj 79 0
BIN#Stream obj 77 0
BIN#Stream obj 88 0
BIN#Stream obj 87 0
BIN#Stream obj 86 0
BIN#Stream obj 84 0
BIN#Stream obj 95 0
BIN#Stream obj 94 0
BIN#Stream obj 92 0
BIN#Stream obj 102 0
BIN#Stream obj 101 0
BIN#Stream obj 99 0
BIN#Stream obj 109 0
BIN#Stream obj 108 0
BIN#Stream obj 106 0
BIN#Stream obj 116 0
BIN#Stream obj 115 0
BIN#Stream obj 113 0
BIN#Stream obj 124 0
BIN#Stream obj 123 0
BIN#Stream obj 122 0
BIN#Stream obj 120 0
BIN#Stream obj 131 0
BIN#Stream obj 130 0
BIN#Stream obj 128 0
BIN#Stream obj 138 0
BIN#Stream obj 137 0
BIN#Stream obj 135 0
BIN#Stream obj 145 0
BIN#Stream obj 144 0
BIN#Stream obj 142 0
BIN#Stream obj 152 0
BIN#Stream obj 151 0
BIN#Stream obj 149 0
BIN#Stream obj 158 0
BIN#Stream obj 156 0
BIN#Stream obj 167 0
BIN#Stream obj 166 0
BIN#Stream obj 164 0
BIN#Stream obj 174 0
BIN#Stream obj 173 0
BIN#Stream obj 171 0
BIN#Stream obj 181 0
BIN#Stream obj 180 0
BIN#Stream obj 178 0
BIN#Stream obj 187 0
BIN#Stream obj 185 0
BIN#Stream obj 194 0
BIN#Stream obj 193 0
BIN#Stream obj 191 0
BIN#Stream obj 200 0
BIN#Stream obj 198 0
BIN#Stream obj 206 0
BIN#Stream obj 204 0
BIN#Stream obj 213 0
BIN#Stream obj 212 0
BIN#Stream obj 210 0
BIN#Stream obj 220 0
BIN#Stream obj 219 0
BIN#Stream obj 217 0
BIN#Stream obj 226 0
BIN#Stream obj 224 0
BIN#Stream obj 232 0
BIN#Stream obj 230 0
BIN#Stream obj 239 0
BIN#Stream obj 238 0
BIN#Stream obj 236 0
BIN#Stream obj 243 0
BIN#Stream obj 251 0
BIN#Stream obj 250 0
BIN#Stream obj 249 0
BIN#Stream obj 247 0
BIN#Stream obj 259 0
BIN#Stream obj 258 0
BIN#Stream obj 257 0
BIN#Stream obj 255 0
BIN#Stream obj 265 0
BIN#Stream obj 263 0
BIN#Stream obj 272 0
BIN#Stream obj 271 0
BIN#Stream obj 269 0
BIN#Stream obj 279 0
BIN#Stream obj 278 0
BIN#Stream obj 276 0
BIN#Stream obj 286 0
BIN#Stream obj 285 0
BIN#Stream obj 283 0
BIN#Stream obj 293 0
BIN#Stream obj 292 0
BIN#Stream obj 290 0
BIN#Stream obj 299 0
BIN#Stream obj 297 0
BIN#Stream obj 306 0
BIN#Stream obj 305 0
BIN#Stream obj 303 0
BIN#Stream obj 313 0
BIN#Stream obj 312 0
BIN#Stream obj 310 0
BIN#Stream obj 317 0
BIN#Stream obj 324 0
BIN#Stream obj 322 0
BIN#Stream obj 328 0
BIN#Stream obj 336 0
BIN#Stream obj 335 0
BIN#Stream obj 333 0
BIN#Stream obj 343 0
BIN#Stream obj 342 0
BIN#Stream obj 340 0
BIN#Stream obj 350 0
BIN#Stream obj 349 0
BIN#Stream obj 347 0
BIN#Stream obj 357 0
BIN#Stream obj 356 0
BIN#Stream obj 354 0
BIN#Stream obj 364 0
BIN#Stream obj 363 0
BIN#Stream obj 361 0
BIN#Stream obj 370 0
BIN#Stream obj 368 0
BIN#Stream obj 376 0
BIN#Stream obj 374 0
BIN#Stream obj 383 0
BIN#Stream obj 382 0
BIN#Stream obj 380 0
BIN#Stream obj 390 0
BIN#Stream obj 389 0
BIN#Stream obj 387 0
BIN#Stream obj 397 0
BIN#Stream obj 396 0
BIN#Stream obj 394 0
BIN#Stream obj 404 0
BIN#Stream obj 403 0
BIN#Stream obj 401 0
BIN#Stream obj 411 0
BIN#Stream obj 410 0
BIN#Stream obj 408 0
BIN#Stream obj 418 0
BIN#Stream obj 417 0
BIN#Stream obj 415 0
BIN#Stream obj 425 0
BIN#Stream obj 424 0
BIN#Stream obj 422 0
BIN#Stream obj 429 0
BIN#Stream obj 434 0
BIN#Stream obj 438 0
BIN#Stream obj 445 0
BIN#Stream obj 444 0
BIN#Stream obj 442 0
BIN#Stream obj 451 0
BIN#Stream obj 449 0
BIN#Stream obj 457 0
BIN#Stream obj 455 0
BIN#Stream obj 465 0
BIN#Stream obj 464 0
BIN#Stream obj 463 0
BIN#Stream obj 461 0
BIN#Stream obj 472 0
BIN#Stream obj 471 0
BIN#Stream obj 469 0
BIN#Stream obj 479 0
BIN#Stream obj 478 0
BIN#Stream obj 476 0
BIN#Stream obj 486 0
BIN#Stream obj 485 0
BIN#Stream obj 483 0
BIN#Stream obj 493 0
BIN#Stream obj 492 0
BIN#Stream obj 490 0
BIN#Stream obj 500 0
BIN#Stream obj 499 0
BIN#Stream obj 497 0
BIN#Stream obj 507 0
BIN#Stream obj 506 0
BIN#Stream obj 504 0
BIN#Stream obj 513 0
BIN#Stream obj 511 0
BIN#Stream obj 520 0
BIN#Stream obj 519 0
BIN#Stream obj 517 0
BIN#Stream obj 526 0
BIN#Stream obj 524 0
BIN#Stream obj 530 0
BIN#Stream obj 541 0
TXTStructure
PYCencoders.pyc
PYCerrors.pyc
PYCfeedparser.pyc
PYCgenerator.pyc
PYCheader.pyc
PYCheaderregistry.pyc
PYCiterators.pyc
PYCmessage.pyc
BINmime
PYCapplication.pyc
PYCaudio.pyc
PYCbase.pyc
PYCimage.pyc
PYCmessage.pyc
PYCmultipart.pyc
PYCnonmultipart.pyc
PYCtext.pyc
PYC__init__.pyc
PYCparser.pyc
PYCpolicy.pyc
PYCquoprimime.pyc
PYCutils.pyc
PYC_encoded_words.pyc
PYC_header_value_parser.pyc
PYC_parseaddr.pyc
PYC_policybase.pyc
PYC__init__.pyc
BINinfo
DLLAdvanceBackup.dll
Structure
BIN.Net Resources
BINAdvanceBackup.AdvancedBackup.resources
BINAdvanceBackup.ExchangeRestoreSteps.resources
BINAdvanceBackup.Exchange.ExchangeServerControl.resources
BINpictExchRstHelp.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictLocalBkpHelp.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAdvanceBackup.Exchange.ExchBrickControl.resources
BINAdvanceBackup.Office365.Office365Control.resources
BINAdvanceBackup.Oracle.OracleServerControl.resources
VBSAdvanceBackup.Properties.Resources.resources
BINib_ico_loginrefresh_click
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_ico_loginrefresh_hover
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_ico_loginrefresh_normal
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_miniarrow
BINib_miniarrow_desc
BINib_miniarrow_new
BINib_serverico_backup
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_backup_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_backup_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_restore
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_restore_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_restore_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_big_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_big_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_big_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_medium_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_medium_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_medium_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_small_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_small_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_small_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_cbt_tooltip
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_connecting2
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_help12_1
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_msgbox_hedbg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_pic_Close
BINids_btn_serverlogin_click
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINids_btn_serverlogin_hover
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINids_btn_serverlogin_normal
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpause_btn
IMG[NBF]root.Data
BINplay_btn
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpopup_logo
IMG[NBF]root.Data
BINwhitedownarrow_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwhitedownarrow_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAdvanceBackup.SharePoint.SharePointControl.resources
BINAdvanceBackup.SQLLogin.resources
BINimageList1.ImageStream
DATA[NBF]root.Data
BINAdvanceBackup.SQLServer.SQLServerControl.resources
BINpictpauseresume.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAdvanceBackup.SystemState.SystemStateControl.resources
BINAdvanceBackup.VMWare.VMwareControl.resources
BINAdvanceBackup.VMware.VMwareLogin.resources
BINpictLoginClose.Image
BINAdvanceBackup.VMware.vmwRestoreSummary.resources
BINpictBoxLogo.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINResources
BINRT_VERSION
BINID:0001
BINID:0
VBSunins000.datT1059.005
EXEunins000.exe
Structure
P7B[Authenticode]_046e6fde.p7b
BINResources
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINRT_BITMAP
BINID:0000
BINID:0
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
IMGID:1033
IMGID:1033-preview.png
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINRT_STRING
BINID:0FF0
BINID:0
BINID:0FF1
BINID:0
BINID:0FF2
BINID:0
BINID:0FF3
BINID:0
BINID:0FF4
BINID:0
BINID:0FF5
BINID:0
BINID:0FF6
BINID:0
BINID:0FF7
BINID:0
BINID:0FF8
BINID:0
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
EXEID:1033
Structure
BINOverlay_8ad664d7.bin
BINResources
BINRT_STRING
BINID:0001
BINID:1027
BINID:1028
BINID:1029
BINID:1030
BINID:1031
BINID:1032
BINID:1033
BINID:1034
BINID:1035
BINID:1036
BINID:1038
BINID:1039
BINID:1040
BINID:1041
BINID:1042
BINID:1043
BINID:1044
BINID:1045
BINID:1046
BINID:1049
BINID:1051
BINID:1053
BINID:1055
BINID:1060
BINID:1069
BINID:2052
BINID:2070
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:1033
BINID:0
BINRT_GROUP_CURSOR2
BINID:7FFA
BINID:1033
BINID:7FFB
BINID:1033
BINID:7FFC
BINID:1033
BINID:7FFD
BINID:1033
BINID:7FFE
BINID:1033
BINID:7FFF
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
MSGunins000.msg
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
16 / 16
Path
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.4 |
| Author | Flexense Ltd. |
| CreationDate | D:20260204125540+02'00' |
| Creator | PDFCreator Version 1.2.3 |
| Keywords | DiskPulse, Disk Change Monitor |
| ModifiedDate | D:20260204125540+02'00' |
| Subject | DiskPulse Disk Change Monitor |
| Title | DiskPulse Disk Change Monitor |
| Producer | GPL Ghostscript 9.04 |
| /Producer | GPL Ghostscript 9.04 |
| /CreationDate | D:20260204125540+02'00' |
| /ModDate | D:20260204125540+02'00' |
| /Title | DiskPulse Disk Change Monitor |
| /Creator | PDFCreator Version 1.2.3 |
| /Author | Flexense Ltd. |
| /Keywords | DiskPulse, Disk Change Monitor |
| /Subject | DiskPulse Disk Change Monitor |
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 635 files
ZIPc3c3fc553049fafd94dd87113842c346T1059.005 · T1059.007CVE-2019-9674
BINlogging
DLLlibffi-8.dll
DLLlibssl-3.dll
DLLpython315.dll
Structure
BINOverlay_2939085c.bin
BINResources
EXESet_up.exe
DLLsqlite3.dll
DLLttdrecord.dll
DLLvcruntime140.dll
BINemail
BINinfo
DLLAdvanceBackup.dll
VBSunins000.datT1059.005
EXEunins000.exe
MSGunins000.msg
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
c3c3fc553049fafd94dd87113842c346 › info › unins000.dat
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account