Extracted

• • Target

    ORDER_230320.pdf.vbs

  • Size

    267KB

  • MD5

    a4876007d9afb92163ed9933656eacbd

  • SHA1

    8eafbf2887bb39ac089c95b50bf34fd27b7ee36f

  • SHA256

    a58c4155a01aab820977ec8d2880edc9408b320f54ec7089db79e50da1b525a7

  • SHA512

    8db4e28e3e1718416c1a3dfe7d461efd429345621f30bfe2f3b67532e2c26833a53b57a89cd4b3587488bf017926076b12b92ec15e1868babe5ded766cfa335c

  • SSDEEP

    768:NGiZmuiZO+YlWGNOHGxOrBr/kXiFs6d3f9GdsGd+9dP1EC4SV5BW:l

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2