Extracted

• • Target

    swift copy.PDF.js

  • Size

    453KB

  • MD5

    811a102d237ae380b2d9517fa79f2c6d

  • SHA1

    17ff05d6c71c7c3f27be24cfd46b9653de9f67f2

  • SHA256

    47ac55851c62e30f0553a5d32f2b6a128f532b9904fbf5e100b53895ec8a86ca

  • SHA512

    3fcd5e98e5dbe0fb529ca77592bc012bc8560173114dfa754d363fe621b9336485a74fa48bd8bca4f676bfc91c2dc8ad5bc69c9a3b275b02722ec4e932688680

  • SSDEEP

    6144:N5gPKUmu6hIe4UhL60X4dOvNJ38QJfJiDzh8qQESvpWvnR4Rt1Prz2fLFh2WR:N56fmu6mUhZVJ1J8DnRvAtlf2

  Score

  10^/10

  vjw0rmtrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2