Back to Malware Drops
d97f0f402bd65a9c26aa266246b0894c8d6762e82373377641ca779c46406299
MD5477d9862374177c810b0b7d73b4f1e53
SSDEEP96:74+9Xlzlye7SjptKzN5hHsqg1tqmCio8NRUWw/zIZ+zj8ZSYyCvzovtahVOkIE:7f7AZUhbg6/O+P+nLM4p
File Typeunknown
Size6.9 KB
Sources58
Downloads0
First SeenFeb 28, 2024
Last SeenFeb 28, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (19)
- 004894[.]gif
- copyright[.]html
- document[.]searchForm
- document[.]searchForm[.]group[.]value
- document[.]searchForm[.]keyword[.]value
- document[.]searchForm[.]submit
- download[.]oracle[.]com
- feed-icon-14x14[.]png
- history[.]back
- hp-styles[.]css
- index[.]html
- master-master[.]css
- oralogo-small[.]gif
- privacy[.]html
- search-icon-search-icon[.]gif
- search[.]oracle[.]com
- spacer[.]gif
- this[.]keyword[.]value
- www[.]oracle[.]com
url (9)
- hxxp://download[.]oracle[.]com/index[.]html
- hxxp://search[.]oracle[.]com/search/search
- hxxp://www[.]oracle[.]com
- hxxp://www[.]oracle[.]com/html/copyright[.]html
- hxxp://www[.]oracle[.]com/html/privacy[.]html
- hxxp://www[.]oracle[.]com/rss/index[.]html
- hxxp://www[.]oracle[.]com/technetwork/indexes/downloads/index[.]html
- hxxp://www[.]oracle[.]com/technetwork/indexes/products/index[.]html
- hxxp://www[.]oracle[.]com/us/sitemaps/index[.]html#otn