Extracted

• • Target

    ORDER-23023A_pdf.js

  • Size

    7KB

  • MD5

    933b4514edd326ee6e30c96cd77d82f9

  • SHA1

    6d5cb6a10bb6483f6ceaa704b7ec96afa505ba10

  • SHA256

    7322460676a315a08fd2e0a2d3dc6c9d25225fca29d1aa21428bc38354cbbcbe

  • SHA512

    551613e20d98d59b1f9d225c57351717094c32a6f47fd8d994863e0e7e834d8e419dfaa41bf80dc7e229102f3b6bcd58cf41bb03562279a20fa689192444822f

  • SSDEEP

    96:EPq4bVViLK3Zo7PjEA914wVViC8a4fEVUcx3GNwqEq4S2VViyKLoyrV9RdACUNVL:5jbLLgDzj/KK8AhbhxnC+dTO

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2