Extracted

• • Target

    32_94_payment_bv_xls.js

  • Size

    300.0MB

  • MD5

    62cc1b7497b1c6483cdee99cf94aaaea

  • SHA1

    60c51b7d03bc0b5215fe3cbd9f52cfb89bcf8d74

  • SHA256

    fd38f9a079dd0bd1808baa9c7dcade49a11eda5cade2bf4197bd1aa00d8fe6aa

  • SHA512

    f43113d41e7c0043e26e8f94e9395db2fe531d87104151db8719736432d2466412ae0402cff9f892795e455faef83cbe80bca59a72abfcbfe31061bed3d96df7

  • SSDEEP

    768:L6Nrj4rmY+ABYSZy1YrmyBFcuYyYxy1Y0RrFrX:L6

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2