Overview

overview

10

Static

static

DHL_INVOIC...pdf.js

windows7-x64

10

DHL_INVOIC...pdf.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL_INVOICE DOCUMENTS.pdf.zip

  • Size

    14KB

  • Sample

    221223-jarc8sga89

  • MD5

    776728fcb09bd43d6c762d846457ffd3

  • SHA1

    6f9a7e226cbb84386674f77ef451162fb75001f6

  • SHA256

    ee82df2b428d8464e4ac7bee92182e278137e5e9638a2d31c5d24ecc57d6bb9c

  • SHA512

    9b9d35f7a9c511c2f2e6caee3e182cd5135c057773673799f94fa302b863bc8141fb0168061dfbad08b18225c72da0fe1be441343bd40a8fd5107c919485ddb4

  • SSDEEP

    384:+iaED4zaujjZLIX5dnIfWs4llct40BUB1qRVRkebyF3R:+iaEDeaujquWFl1yUS7Rke2BR

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      DHL_INVOICE DOCUMENTS.pdf.js

    • Size

      39KB

    • MD5

      728ad59ffec76f58dce2aa113c5c42c3

    • SHA1

      fede8848c27498a5a0d5f3738410aa996271654e

    • SHA256

      48ef19b9669fe0fa15daa9a81eab58f28ea9c4a4d01c502422bf71e7a882eaee

    • SHA512

      f3a3ede48e4e1c4ece4381e66950b3e713dc4a484ecb195feaf860c24d4169fe7d635d34a9ec4c707f8339e288b047eeb8807ad8aa125c4f26ccb385b633de43

    • SSDEEP

      768:sjLTSr8U0fXfpYiLnkSl5hjs/2JqmT9Kj+VcegMsx1ict:SrUMY+9l5hjs/2JqmT9KS2jx4ct

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks