Extracted

• • Target

    swiftcopy29,000-pdf.js

  • Size

    851KB

  • MD5

    937dc6d86aaec946b8b1a85c18dfc0f9

  • SHA1

    54cffa114d9190531e7ea511fcb3366891cdec78

  • SHA256

    0709e45b9186e29e63b1201836886b878e3d58ab49839aad499982909e6f2a70

  • SHA512

    21239b6c8b1fef9cf1589110c43d586a42bf74fdabc9782df92042bc80c0ff66147837d227b02ec039d0ceac66a6ca2135edfeaab0f207b934157cd51daf3ea5

  • SSDEEP

    6144:ZPCzWsMvIvVtVys9ViggID8N7dxjZNQySzE70Gd:0MvQ/VnQAD8JdxjZKO0Gd

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2