Overview

overview

10

Static

static

Company Pr...pdf.js

windows7_x64

10

Company Pr...pdf.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Company Profile Shelton 3.5-pdf.js

  • Size

    22KB

  • Sample

    210805-gcepwa61w2

  • MD5

    883d87e7b34ac592789086eedbd6b42a

  • SHA1

    dc4c1dff91b1955f9ff83ca9ad6bb06329667814

  • SHA256

    b33cba05272e309fcc4be1b2fc07c719eaa0118c28f14f9636431f1b0d844121

  • SHA512

    edbacded336d8f163b1e3aa741bbbd44c9d29f864fdf4c7604d346ca073ea1726d25b346db4ee53a4794e729cbcce90e4aacffed66ea8e7d986dd255d435fb64

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      Company Profile Shelton 3.5-pdf.js

    • Size

      22KB

    • MD5

      883d87e7b34ac592789086eedbd6b42a

    • SHA1

      dc4c1dff91b1955f9ff83ca9ad6bb06329667814

    • SHA256

      b33cba05272e309fcc4be1b2fc07c719eaa0118c28f14f9636431f1b0d844121

    • SHA512

      edbacded336d8f163b1e3aa741bbbd44c9d29f864fdf4c7604d346ca073ea1726d25b346db4ee53a4794e729cbcce90e4aacffed66ea8e7d986dd255d435fb64

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks