Extracted

• • Target

    H656_Payment_receipt_Pdf.js

  • Size

    300.0MB

  • MD5

    606730f4cf8cb008adb76fe44b85d6dd

  • SHA1

    84a3a53eab776e4efc24b2149b262e4bbd3c1d6b

  • SHA256

    383161ff3e03ff39f396725cef6bae622040bcd5aff25df8b147c1fd9639daef

  • SHA512

    e5bfd75ec3993672c893bdd456dbd5839a392425ee8c5d802f87f4e5fb23ee24b4c9027c1818f2f4ca6f2667c1f1658b15b7f8bdbbb4aa21eedbb1dfb5c5e6df

  • SSDEEP

    192:EZYg0luzi75WbAZvD1hdh12cB5kw94tMa3dZYkVdPrv1kc8KuIVLk5/lWWWnazhC:EZfz5Khy24jHuHFqWWsW8WHKSqm7S

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2