Extracted

• • Target

    Purchase Order.pdf.exe

  • Size

    1.1MB

  • MD5

    59fe7f9b463780a6d838c46cef1844aa

  • SHA1

    7f804ea8fbf9485b3b64322a90225f733e213c52

  • SHA256

    e60a8a900480ed3d410440b2805a6bfe7d34dd704afa809851cf74ce68358859

  • SHA512

    919711ee14d4ada6c7b442c6f789be2a3f42b3dfbdb899bc5daf4014ccdea5dbfa8afdddf2b139f8fb5c6bc52a5a220254985c4b20d212b09dbed4b16fc24860

  • SSDEEP

    12288:+cfAmIbRN8XxzKJ2uLZzQkDsRLI3/EzSzKvF5S6c5ofg70kaX84hGoJPF5Co440r:VnIbRuFTkZ1WwZz6Rwoo7A1xXCod0QM

  Score

  10^/10

  oskidiscoveryinfostealerspywarestealer

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2