Extracted

• • Target

    EDF.vbs

  • Size

    310KB

  • MD5

    cbf05819243b31316e14ee97ea658361

  • SHA1

    c622321a755761d7c9e9788af0adce9eaa3d18e3

  • SHA256

    068536ef2ccdc4c09fe3da66f911453be231263e8180c817899dbc2872547d16

  • SHA512

    66ac258f43efc76d7db466cc1377b680b88b68648e41a7abf0386a5282ee210c9ec7be6ac4dd29269627d2f13ae1710b6cde24285042fd233045f896360bb6df

  • SSDEEP

    3072:97r/OGPcq3rX5Jcog033nHam2BWntVSbPXM4nnbaB1Hlb9WSWMyprZkXnlOhljes:9/OGPcq3rX5bu

  Score

  10^/10

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2