General
-
Target
FV_ad2021MLltda.Docx.js
-
Size
412KB
-
Sample
210906-ty8mjabcd3
-
MD5
d50491f6dbdf9bbd02d43e5f02ecc58d
-
SHA1
1629504b95ec4975b243f480ec76b357f327e475
-
SHA256
1e95c65bf0fb96be6f5cc0bd8a2672917a19eec232aa0367041e13e7fa3cb0f7
-
SHA512
01edaa962f060b7c8cd72e9c5cf4365ea10725a3bb68f98dcc1712ad0915d551a69ef8cec12505fd8ca1f572a587c494f48abf815d822a134bcbcbf787e32fea
Static task
static1
Behavioral task
behavioral1
Sample
FV_ad2021MLltda.Docx.js
Resource
win7-en
Behavioral task
behavioral2
Sample
FV_ad2021MLltda.Docx.js
Resource
win10v20210408
Malware Config
Targets
-
-
Target
FV_ad2021MLltda.Docx.js
-
Size
412KB
-
MD5
d50491f6dbdf9bbd02d43e5f02ecc58d
-
SHA1
1629504b95ec4975b243f480ec76b357f327e475
-
SHA256
1e95c65bf0fb96be6f5cc0bd8a2672917a19eec232aa0367041e13e7fa3cb0f7
-
SHA512
01edaa962f060b7c8cd72e9c5cf4365ea10725a3bb68f98dcc1712ad0915d551a69ef8cec12505fd8ca1f572a587c494f48abf815d822a134bcbcbf787e32fea
Score10/10-
Blocklisted process makes network request
-
Executes dropped EXE
-
Drops startup file
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-