Overview

overview

10

Static

static

1

ORDER-23023A_pdf.js

windows7-x64

8

ORDER-23023A_pdf.js

windows10-2004-x64

10

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2023, 15:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ORDER-23023A_pdf.js

  • Size

    7KB

  • MD5

    933b4514edd326ee6e30c96cd77d82f9

  • SHA1

    6d5cb6a10bb6483f6ceaa704b7ec96afa505ba10

  • SHA256

    7322460676a315a08fd2e0a2d3dc6c9d25225fca29d1aa21428bc38354cbbcbe

  • SHA512

    551613e20d98d59b1f9d225c57351717094c32a6f47fd8d994863e0e7e834d8e419dfaa41bf80dc7e229102f3b6bcd58cf41bb03562279a20fa689192444822f

  • SSDEEP

    96:EPq4bVViLK3Zo7PjEA914wVViC8a4fEVUcx3GNwqEq4S2VViyKLoyrV9RdACUNVL:5jbLLgDzj/KK8AhbhxnC+dTO

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER-23023A_pdf.js
    1⤵
    • Blocklisted process makes network request
    PID:2012

Network

  • flag-us
    DNS
    grapemundo.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    grapemundo.com
    IN A
    Response
    grapemundo.com
    IN A
    103.50.163.157
  • 103.50.163.157:443
    grapemundo.com
    tls
    wscript.exe
    395 B
     219 B
     5
    5
  • 103.50.163.157:443
    grapemundo.com
    tls
    wscript.exe
    357 B
     219 B
     5
    5
  • 103.50.163.157:443
    grapemundo.com
    tls
    wscript.exe
    288 B
     219 B
     5
    5
  • 103.50.163.157:443
    grapemundo.com
    wscript.exe
    190 B
     132 B
     4
    3
  • 8.8.8.8:53
    grapemundo.com
    dns
    wscript.exe
    60 B
     76 B
     1
    1

    DNS Request

    grapemundo.com

    DNS Response

    103.50.163.157

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.