Extracted

• • Target

    ORDER-230918PA.XLS.js

  • Size

    7KB

  • MD5

    88bf291984995a3806e28a362c5f5bf2

  • SHA1

    5b1362033885067323c063748efdf193d8ee710d

  • SHA256

    fba9f9a0ff16e84ba7fc7b57850f86a1865391ac840f340f6fab233339b20919

  • SHA512

    8074ab938b1a7a4c4c778009e5cf1c7a773eaef97ebdf3503a3771aa98ef575a1010d7654a17a9b3727134e98eb0d13fbcd0405a39ce8dac199bd8b5132c9f09

  • SSDEEP

    48:60ZwVq3vMB5tVk6VVUPN2MTwmyrV2QJ1qXwnqNAsVEWEF:i7

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2