Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers
Common Information
| Type | Value |
|---|---|
| UUID | f70d1228-8e3a-4ae6-8886-d3cfc4008aa0 |
| Fingerprint | 47513c4adc9959796be803de1ffc764e1b018cbcbd00706532f2a1cef3cf8905 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Dec. 4, 2019, 10:20 a.m. |
| Added to db | April 18, 2024, 10:52 a.m. |
| Last updated | Aug. 31, 2024, 1:17 a.m. |
| Headline | Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers |
| Title | Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers |
| Detected Hints/Tags/Attributes | 159/3/195 |
Source URLs
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | CVE | 4 | cve-2018-8570 |
|
| Details | CVE | 375 | cve-2017-11882 |
|
| Details | CVE | 269 | cve-2017-0199 |
|
| Details | CVE | 51 | cve-2014-1761 |
|
| Details | CVE | 176 | cve-2012-0158 |
|
| Details | CVE | 117 | cve-2018-0802 |
|
| Details | CVE | 58 | cve-2018-0798 |
|
| Details | CVE | 30 | cve-2015-7645 |
|
| Details | CVE | 57 | cve-2016-4117 |
|
| Details | CVE | 32 | cve-2016-1019 |
|
| Details | CVE | 63 | cve-2017-8570 |
|
| Details | Domain | 247 | www.virusbulletin.com |
|
| Details | Domain | 2 | anomali.com |
|
| Details | Domain | 202 | proofpoint.com |
|
| Details | Domain | 358 | pastebin.com |
|
| Details | Domain | 3 | mtanews.vzglagtime.net |
|
| Details | Domain | 5 | enterprise.verizon.com |
|
| Details | Domain | 170 | www.sans.org |
|
| Details | Domain | 22 | reeye.com |
|
| Details | Domain | 403 | securelist.com |
|
| Details | Domain | 23 | paper.seebug.org |
|
| Details | Domain | 8 | threatvector.cylance.com |
|
| Details | Domain | 4127 | github.com |
|
| Details | Domain | 16 | www.anquanke.com |
|
| Details | Domain | 8 | myonlinesecurity.co.uk |
|
| Details | Domain | 6 | dodcio.defense.gov |
|
| Details | Domain | 17 | www.anomali.com |
|
| Details | Domain | 1373 | twitter.com |
|
| Details | Domain | 224 | unit42.paloaltonetworks.com |
|
| Details | Domain | 317 | bit.ly |
|
| Details | 1 | gsaad@anomali.com |
||
| Details | 1 | mraggi@proofpoint.com |
||
| Details | File | 6 | qclite.dll |
|
| Details | File | 5 | qcconsol.exe |
|
| Details | File | 1122 | svchost.exe |
|
| Details | File | 142 | wmiprvse.exe |
|
| Details | File | 2 | afer125419.tmp |
|
| Details | File | 3 | жагсаалт.doc |
|
| Details | File | 3 | team.doc |
|
| Details | File | 20 | rastls.dll |
|
| Details | File | 4 | intelgraphicscontroller.exe |
|
| Details | File | 2 | summit_archive_1548184559.pdf |
|
| Details | File | 1 | malware_evad.html |
|
| Details | File | 3 | normanshark-maudioperation.pdf |
|
| Details | File | 2 | reaver-mapping-connections-between-disparate-chinese-apt-groups.html |
|
| Details | File | 2 | cyberdis-impplan.pdf |
|
| Details | Github username | 15 | decalage2 |
|
| Details | md5 | 1 | 01050000020000000B00000045717561 |
|
| Details | md5 | 1 | 01050000020000000b00000045717561 |
|
| Details | md5 | 3 | e228045ef57fb8cc1226b62ada7eee9b |
|
| Details | md5 | 2 | 5cc1272272a6de91e1c43832f289c73f |
|
| Details | sha1 | 1 | 01050000020000000b0000004571756174696f6e |
|
| Details | sha1 | 1 | 4696f6e2e33000000000000000000002e0000d01 |
|
| Details | sha256 | 2 | 941868f366d65c8859253c869e405c5bbb91e1ed0227090656295c54bb0be9f2 |
|
| Details | sha256 | 2 | a58366b412b6d3c5aeebd716ae81b892b51bd5dbafbe26c5bac79f06912085eb |
|
| Details | sha256 | 3 | 9d0c4ec62abe79e754eaa2fd7696f98441bc783781d8656065cddfae3dbf503e |
|
| Details | sha256 | 3 | 332aa26d719a20f3a26b2b00a9ca5d2e090b33f5070b057f4950d4f088201ab9 |
|
| Details | sha256 | 3 | bd1e7b42a9c265266b8cc5cc966470497c4f9cba2b247d1f036b6b3892106b52 |
|
| Details | sha256 | 2 | 8f81142a9482c2a96c43c4b325f90794c2a32b61e8261da55f306a36df9ec18c |
|
| Details | sha256 | 3 | b70069e1c8e829bfd7090ba3dfbf0e256fc7dfcefc6acafb3b53abcf2caa2253 |
|
| Details | sha256 | 2 | dd89d33e275e99e288e4c50bdafbb4584a9565189491af0a66f8a506eaf53859 |
|
| Details | sha256 | 3 | 42162c495e835cdf28670661a53d47d12255d9c791c1c5653673b25fb587ffed |
|
| Details | sha256 | 2 | c374f7f30b34d95dd99d9cf16f54192d439f830918d342558945e5809809b847 |
|
| Details | sha256 | 2 | 344fbc5e86e6477cdb24848ace149303e22b41f7b01b2eca923109868c1f458f |
|
| Details | sha256 | 2 | 46714a1fd1a5ce598f761a885857dee8d90b6e7d6f4a303ecaec246a77b58fff |
|
| Details | sha256 | 2 | b45087ad4f7d84758046e9d6eb174530fee98b069105a78f124cbde1ecfb0415 |
|
| Details | sha256 | 2 | 44e564ab86be5be2ce5f31c9072cd05adb91663be4904759cbcafa30c5b87660 |
|
| Details | sha256 | 2 | ab35b2b22718624fcaf1a290b3f138c009469b7449d1a280ec67767ea55b44ae |
|
| Details | sha256 | 2 | 152f95a5bdf549c5ca789d0dd99d635ee69cca6fe464ced5b39d0316707a4914 |
|
| Details | sha256 | 2 | f2e28b48ee338fddd97272b191a55641c7835ad687d7b65c8db1c5f747811c57 |
|
| Details | sha256 | 3 | 130daacff74d57bb2319fc5cf815e783c6505883f69e4adcd4c2b1cac3e598ce |
|
| Details | sha256 | 2 | eb772b325bdeaaa551a4f50399fe6059bc856e41ba23dd14fbc956605a9c838e |
|
| Details | sha256 | 2 | c6a01f392e4c317e6c9b6b3ce860f6368fad7687336ce995246d01fb52b83ca4 |
|
| Details | sha256 | 2 | bf9987b84b3f7daaa460777e5850a60f10898d0238048d3d5d07d7ec1656e47a |
|
| Details | sha256 | 2 | afcbe545dc27d757fb1231019248fdd6b3ec2237e09007656d0ccd4de094f2ef |
|
| Details | sha256 | 2 | 81f75839e6193212d71d771edea62430111482177cdc481f4688d82cd8a5fed6 |
|
| Details | sha256 | 2 | d732a7741182741b6c14fdce201b839c8e380be242de034ce764c61778be8fc1 |
|
| Details | sha256 | 2 | 5e7663f662cedcc2c520b88928824a4c7caf5a6833f77cdb0051328d74ace1c8 |
|
| Details | sha256 | 2 | 41f0757ca4367f22b0aece325208799135c96ebe1dcafcd752d3f3c8dd4a5ccf |
|
| Details | sha256 | 2 | a9b3b44f048cc145bd4703ead369c9104746966f94b679da51d97bf7b70a26fb |
|
| Details | sha256 | 2 | aa4874e3d49e9765797b96aff5262b802352e575deee17308f7539f8916fac33 |
|
| Details | sha256 | 2 | 1c6cb02ae9dceb3a647260f409dd837fa5c66794804623c9cf97395cf406d4df |
|
| Details | sha256 | 2 | 9ac09ea38c9cf11ca13a2c3dbdcfbe0fe4a15cb609be451f7159ecebdd20d311 |
|
| Details | sha256 | 2 | 3df19abbf961a6d795362f5408d65aa5a31e34620aa3518a010d4d6d9e79c60e |
|
| Details | sha256 | 2 | 5e3cd28d9ab02de8d816b7a0719e715330b4ad28cb2d2778a5f54a3396620991 |
|
| Details | sha256 | 2 | 16cb245d9a78c81c25605695a2cf8dbdb36d85bcb61726c56ee358254253df2e |
|
| Details | sha256 | 2 | 1e78ebbfb5fd1ee66f44030d52f80806d184e6daa00dd7aaa1a30b53c629912d |
|
| Details | sha256 | 2 | 9be6d671dd901326fc834296fbd2ed015d64e6037e83d8d1d08a9dcdc107cb33 |
|
| Details | sha256 | 2 | 5898e729b7305c4e5db54847396b15d06b74153213a242d295cf64c951a021ca |
|
| Details | sha256 | 2 | 803c25767414c31259e15f058d62b6102dfe09d3cfacece57f527d7fb2a50632 |
|
| Details | sha256 | 2 | c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8 |
|
| Details | sha256 | 2 | c92a26c42c5fe40bd343ee94f5022e05647876daa9b9d76a4eeb8a89b7f7103d |
|
| Details | sha256 | 2 | c67625e2b5e2f01b74e854c0c1fdf0b3b4733885475fe35b80a5f4bca13eccc7 |
|
| Details | sha256 | 2 | 138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b |
|
| Details | sha256 | 3 | c0b8d15cd0f3f3c5a40ba2e9780f0dd1db526233b40a449826b6a7c92d31f8d9 |
|
| Details | sha256 | 4 | f5365387320ae6e6907fd2700f340ba8712cb08f7e52b2ec4dccfe99b3d648ef |
|
| Details | sha256 | 5 | 9d239ddd4c925d14e00b5a95827e9191bfda7d59858f141f6f5dcc52329838f0 |
|
| Details | sha256 | 4 | a95bbc1f067783c1107566ed7897549f6504d5367b8282efe6f06dc31414c314 |
|
| Details | sha256 | 4 | 4e1a2f731688f9aab80b1f55d9101bb1cddec08214d4379621c434899a01efbf |
|
| Details | sha256 | 5 | 597c0c6f397eefb06155abdf5aa9a7476c977c44ef8bd9575b01359e96273486 |
|
| Details | sha256 | 3 | 71c94bb0944eb59cb79726b20177fb2cd84bf9b4d33b0efbe9aed58bb2b43e9c |
|
| Details | sha256 | 3 | 722e5d3dcc8945f69135dc381a15b5cad9723cd11f7ea20991a3ab867d9428c7 |
|
| Details | sha256 | 4 | c580d77722d85238ed76689a17b0205b4d980c010bef9616b8611ffba21b142e |
|
| Details | sha256 | 2 | 87114b56ef4de4500fd0c64af913915f159b95e3cbdb7932772230aae8bfed40 |
|
| Details | sha256 | 2 | 60ac67f0511fc984990e826d44e8a5eddd1ab7f21c7d847ee3a821875260cea6 |
|
| Details | sha256 | 2 | 61488eaafad84e8b86c6a2e87b022e133ccc77701f817c589ef4b01a89dd74ee |
|
| Details | sha256 | 2 | f3c120cde34e4e2a45d924ada9e53d3ebc7d73132e359eca8d48f813b6e021a1 |
|
| Details | sha256 | 2 | ec46e1feed5199a332c76021a8bb446dca37b8e736bcd1e5505f35fb70526a04 |
|
| Details | sha256 | 2 | 5d4de75f7900b6e765d8878234e06d8e07490d5decc6ec5d41c704af38a0abc5 |
|
| Details | sha256 | 3 | 4fce3d38e0a308088cd75c2ef1bb5aa312e83447d63a82f62839d3609a283b02 |
|
| Details | sha256 | 3 | 4123a19cda491f4d31a855e932b8b7afdcf3faf5b448f892da624c768205a289 |
|
| Details | sha256 | 2 | a3e81e5bbf5beeb9568f0c801b2407e33cf9bcc0c12842d6bd6bc62280add81d |
|
| Details | sha256 | 2 | 70195e390a5cb92c2e32ded9ef80a935ad7bdda6d6d8e21cc4cf74e98998de32 |
|
| Details | sha256 | 2 | 532b68e6bbcea3980f5fc9a2d939b062b1e3f5f5175267adc158d3a877204e1e |
|
| Details | sha256 | 2 | b9e1145546dba4fe2428fdb43566a7eb5ac472bd8b5e5f30998477693a08ede1 |
|
| Details | sha256 | 2 | e8e86359b06cefdc5c1115dacea21240aa090450e83744b495e784d8bff49a09 |
|
| Details | sha256 | 4 | 5238f8d8c3d16b52d39aa722daff663a5e6307c4b46e360969d84bf409a2690f |
|
| Details | sha256 | 2 | 97c0ba7e6cb7eb507bb6e9d819786240292f2c3c72e4d7732dd007a9bbf4af5e |
|
| Details | sha256 | 2 | 69f44ca082ed90c97d9c4ebaae589d7e41c69b02e582cc69886ebfd9cfb93951 |
|
| Details | sha256 | 2 | 4f6b8f51fdaf708bb4fa0dbbc72da50d24f694bce2996eff3df7eeb3c1592e62 |
|
| Details | sha256 | 2 | 0598a55dad563ffd3d7a0bcdf8699086527104cf3bad1a0d2192fe805bfef84d |
|
| Details | sha256 | 2 | fb2bfa7985be5b9855c7b114d3c201540effc6b7cb249256717d6c56cc069b09 |
|
| Details | sha256 | 2 | 484f52e80141809f7482f027f5eadb5305ee1966f55f64656765b7408e1c60dc |
|
| Details | sha256 | 2 | 52730e7f52afbc6a99d3a83b12b6a8393d1e979e189cffbcf4fba2ff8a7ca99f |
|
| Details | sha256 | 2 | 3504d4583c59ed0fe6c2d916619714f187638bde835908e02d78cf05b1a9be53 |
|
| Details | sha256 | 2 | e757993b2cefe2a7dd7ea3e9222cf40e968af1c82370ee5775f768fa29d5efe5 |
|
| Details | sha256 | 2 | 3b593d85b18c9457f8c52cf0f2c5f1f549518f9422d0a5bb10fb1edf4c9ea303 |
|
| Details | sha256 | 3 | 3e04eb55095ad6a45905564d91f2ab6500e07afcdf9d6c710d6166d4eef28185 |
|
| Details | sha256 | 3 | 7079d8c92cc668f903f3a60ec04dbb2508f23840ef3c57efffb9f906d3bc05ff |
|
| Details | sha256 | 3 | 892859ea9d86fc441b24222148db52eb33cd106c2ac68eafbe83ab0064215488 |
|
| Details | sha256 | 3 | 22062b6bcda194e3734285fed6b2de341c694c52a8f60c9f389f880cefab7644 |
|
| Details | sha256 | 3 | 9001056791a03ec998f26805d462bc2ca336b2c3aeac2e210f73ff841dfe3eec |
|
| Details | sha256 | 2 | 8ec1e8bc139cbd84858c3997f0635fb5640dbd85f73e8b537e3ae7e14d4870ce |
|
| Details | sha256 | 2 | 47880521119cee06588476fdcc7c47a91903366671448650830b7dd310c3c3ea |
|
| Details | sha256 | 2 | 129d74a8f31622e605cea1a03cdac723a5adb002f877c304ef2ceb5f6cdd2654 |
|
| Details | sha256 | 2 | c81d67472715b6d3bf601147ff8e81f670a429ea0fb8ac3ba82a19c02ad38d0b |
|
| Details | sha256 | 2 | c8b5d8f4304725e19edd9ff9e7a8d3325ed06b91adecad691fea23f429072cbd |
|
| Details | sha256 | 2 | 2f193d55f38d1e4149aa2424f79f184e3059469be4ee386276fb946bdc83bc30 |
|
| Details | sha256 | 2 | 2cfb86699b675919d17beeefa5d993f195358bce6119cc9cebea62d149739421 |
|
| Details | sha256 | 2 | 6e8cd76dba16d159c4e68ed15a60af7f86afb0964ed9d2ebe43c6d6af7749397 |
|
| Details | sha256 | 2 | 299cc5c74b5c44aa4c270da19673f20670b00399038d7ad7dac412b91137a552 |
|
| Details | sha256 | 2 | 30298f89888e5104145ecb1c27053640812a1545f3b7c558ec76fe302d2afb04 |
|
| Details | sha256 | 2 | 2c8ee28cc3884d37019f7b29b37634468fcebaff4a6094564b1443de0c32cbd2 |
|
| Details | sha256 | 2 | 48257a0d98cc8d8c31b449f7e4737507031b06a4165b305b498a8b3f136dcd6b |
|
| Details | sha256 | 2 | c9d2728ab7d43379b8b50b3bb05f10bb39f9d073d0ad0e2d533dfab77957d13c |
|
| Details | sha256 | 2 | 5cd4f11155c34ba32382f297776891d6f2d9f747ffbfdba7594e5c4f1fcd0f59 |
|
| Details | sha256 | 2 | d3428b542596490f320b86e5473a80249082580713116aaa8299634524507102 |
|
| Details | sha256 | 2 | 511522dd26bafc2aaf46a861e479455695f85fbde0873b23baaebcadec07bd7e |
|
| Details | sha256 | 2 | 5fae7d03b8113987f3c776f0988af9522688cc9ad53c5072c7cb7ba445e78aef |
|
| Details | sha256 | 2 | b40fefbe1835c440da19145d825d8fbdea179d362009364af09e89b1819a6c52 |
|
| Details | sha256 | 2 | 6be40b52667cc4876a3eabf4b671235b053e0e44bf98f80fa5394c3b2030f4eb |
|
| Details | sha256 | 2 | 0f515163f98845b2b2f85f8a56563a2fe29834643cb067099b209387ff14cb36 |
|
| Details | sha256 | 2 | 8a40970e308c4e00a03a44f7cfb8decf2b788ab054bdc695dbe7225742e15944 |
|
| Details | sha256 | 2 | 4d62e94a8adc8ab177d02ba20af3f50a0bb4a1db995630c5bbb7527c9e46d4be |
|
| Details | sha256 | 2 | 42afaac637e3f9e805464e2bba017ebbf3d0fd87bbea9482088ed2710683942c |
|
| Details | sha256 | 2 | 8dda3787bcee130ff447283fa05fdad2f68a73f6d5c321fbf723ced1660af0e5 |
|
| Details | sha256 | 2 | d1a5280696f1581b0b82a067cff1b5426db0429428ed2553903cc0de3021a764 |
|
| Details | sha256 | 2 | 9341049cd265f8b03bc444de891d4e397cb6daec462e62e50306724fbe0b423f |
|
| Details | sha256 | 2 | 9b7f09f16cd36ff6b50407e1823d7cf030445ad1e055cf9478ef964419c90580 |
|
| Details | sha256 | 2 | 9fa727fbb18f84d7572dc4017bc3d1410af1c469591317415f53e99c06d68b30 |
|
| Details | sha256 | 2 | 898117f2c43d6cfa52af70df919a366a47f31a7c902ee1bd9e2abfc52cf0b9e5 |
|
| Details | sha256 | 2 | 22c09d51ca46efe5bb00c88841fba6ce23247e7982501fcf5f95e0a64120bef6 |
|
| Details | sha256 | 2 | 07c59af6d98a4606a3b7a82c73a6714a6ac597192877a32e908245921d96d88c |
|
| Details | sha256 | 2 | d70e5230a21921169ad729c557a9759879774445648df99eee18aa54b181b2fa |
|
| Details | sha256 | 2 | 90e3f6e5996b378801c0018d0aaaffd46e9e7a1fa058ad4605edf6a43078d23e |
|
| Details | sha256 | 2 | 6347b1a237217fc9d736094eb3d32117f8b397ec808614cddc4cda8c190b8548 |
|
| Details | sha256 | 2 | 8414918e868dcacf59abffdfee10f487488381170f3c044338c5cec62693691c |
|
| Details | sha256 | 2 | c8ec45b617e378f6fbe29027523d53f20138cc1122f899a7f61320a6acf69226 |
|
| Details | sha256 | 2 | 126853c0b4fe9d83c06fd64cd0306b1d038bad12b2f162777e63dd0850afd7ea |
|
| Details | sha256 | 2 | b6f6600d8c655610a2bf3affcaf999b1030d0559ee457b52b2b184e30e95b47e |
|
| Details | sha256 | 2 | d74e7786c5c733e88eaccfbc265e155538a504f530e3ce2639c138277418c716 |
|
| Details | sha256 | 2 | c16f7e2dba5a2c68c0ac0efd8579e9e1260857a1de2c334466c57287e64b67dc |
|
| Details | sha256 | 2 | 4f57853be12840f120bf8dd4a22f16345536b2e38a4dfaa3b3ba1e3792a6e040 |
|
| Details | sha256 | 2 | 37f464da00d5ea3a3644f3856c13427d2c50c64c4af25b4bc9b3ae3c5837dfb9 |
|
| Details | sha256 | 2 | bc785e8fec0e308cc587e557f3a7172b7af58bdeaa6a49c298fb2c5375e8ab6a |
|
| Details | sha256 | 2 | 821eaae98f64db31a6e0dc4b3e4576cc33e8d94b1e122b6397661720704953e1 |
|
| Details | IPv4 | 4 | 217.69.8.255 |
|
| Details | Mandiant Temporary Group Assumption | 44 | TEMP.PERISCOPE |
|
| Details | Mandiant Temporary Group Assumption | 8 | TEMP.TRIDENT |
|
| Details | Mandiant Temporary Group Assumption | 35 | TEMP.HEX |
|
| Details | Threat Actor Identifier - APT | 143 | APT40 |
|
| Details | Url | 1 | https://enterprise.verizon.com |
|
| Details | Url | 10 | https://www.sans.org |
|
| Details | Url | 17 | https://www.fi |
|
| Details | Url | 13 | https://securelist.com |
|
| Details | Url | 1 | https://paper.seebug.org/papers/apt/apt_cybercriminal_campagin/2012 |
|
| Details | Url | 2 | https://threatvector.cylance.com/en_us |
|
| Details | Url | 2 | https://github.com/decalage2/oletools/issues/307 |
|
| Details | Url | 1 | https://www.anquanke.com/post |
|
| Details | Url | 1 | https://myonlinesecurity.co.uk/scan-from-a-samsung-mfp-malspam-delivers-locky- |
|
| Details | Url | 2 | https://dodcio.defense.gov/portals/0/documents/cyber/cyberdis-impplan.pdf |
|
| Details | Url | 1 | https://www.anomali.com/blog/analyzing-digital-quartermasters-in-asia-do-chinese- |
|
| Details | Url | 1 | https://twitter.com/gossithedog |
|
| Details | Url | 4 | https://unit42.paloaltonetworks.com |
|
| Details | Url | 1 | https://unit42.paloaltonetworks.com/aggah- |