Extracted

• • Target

    ORDER-230606_List.pdf.js

  • Size

    7KB

  • MD5

    6dbb855f97d596832fdf8e69305c0eb8

  • SHA1

    b5d5778f7a28da671bdb14eb7c796566761a44f4

  • SHA256

    919ce7c9562ac3c75c038cee89f48b4ef7cc96e7e35ad85bebc2fff7a84fffdf

  • SHA512

    8139f97b8c2712450325013eee8779bab6bbee03199b82ae50c8a7c67f68556b096b286dd71c7ada0a356bf78cb9454d7c483896eca455659ba624596766e215

  • SSDEEP

    96:baKo33jkavQ9jRwGUvsvOwcvgGU83jwujQ9jRwGU+NyEujy48Eujy4U55FNda3Qg:H

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2