Extracted

• • Target
    TNT E-Invoice Cosignment Delivery Notification_pdf.exe
  • Size 1.1MB
  • SHA256 b0dd472a02ed67fe15e20e2faa6167d8c1e9d54c9f0abc95a255197bbf0c0264
  • MD5 22e5a3e8fb401981cfdb4bc0c9235e7d
  • SHA1 5a371efcb5183f96f96082b5fefec1e05b84c21f
  • SHA512 d787f86a0ef8da1f29ea3accc3871fd3e78d9f09dccafe58cf13dbbc2a5a19cdfd22001e0417301b9401f6bea79d68c40119aba5a29db9e931ea98e2d294dba3
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencespyware

  • Modifies WinLogon for persistence

    persistence

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2