Loading malware…
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SolidPDFCreator backdoor - extracted shellcode metadata ... Letter to His Excellency the President/ +-- "Letter to His Excellency the President .exe" <- benign loader (OriginalFilename: Solid PDF Creator) +-- SolidPDFCreator.dll <- malicious DLL (side-loaded)
11 distinct techniques documented for this family, organized by ATT&CK tactic.
ScheduleDailyTaskViaTaskScheduler: register MediumNetMonIt task via ITaskService COM
VirtualAlloc -> VirtualProtect -> EnumSystemLocalesA
DLL loaded via side-loading chain
ScheduleDailyTaskViaTaskScheduler: register MediumNetMonIt task via ITaskService COM
ScheduleDailyTaskViaTaskScheduler: register MediumNetMonIt task via ITaskService COM
VirtualAlloc 0x8A00 + VirtualProtect RWX
The malware decryption algorithm: - XOR each byte with key[i & 0x1F] (rolling 32-byte key) - Reverse first 0x17 bytes - Reverse last 0xA4 bytes
"Letter to His Excellency the President .exe" <- benign loader (OriginalFilename: Solid PDF Creator)
VirtualAlloc 0x8A00 + VirtualProtect RWX
BuildShellcodeBlob: 186 XOR chunks decoded into 0x8800-byte blob
EnumSystemLocalesA callback at Mem+0xD0 hands control to shellcode
CreateEventW ( NULL , FALSE , FALSE , L"uydgcfteionxcfd" ) ; DWORD dwErr = GetLastError ( ) ; if ( dwErr == ERROR_ALREADY_EXISTS
SetFileAttributesW(target, FILE_ATTRIBUTE_NORMAL|FILE_ATTRIBUTE_HIDDEN=0x82)
GetModuleFileNameW(NULL, wszFilename, 260) ... Compare against canonical target ... C:\ProgramData\IDM\logs\
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.