Extracted

• • Target

    PO-2301219.pdf.js

  • Size

    7KB

  • MD5

    5fe7d726ea15e34b1f6a1714ddb48d87

  • SHA1

    2cdb4dce092ca63a1ed167b9c6243e507c9c3fa7

  • SHA256

    bf99dfce3ae6d9fd2b54471c7de258d38113ac687b59b8233099190b0d05ba69

  • SHA512

    123c9af8aa20f3ef1369080104c3b34a615424a1c23e7d944ef8aa7d18c9106d120229edbff5995748da17433ee8017c6750a5dadab805bdaa805bffc9bc4988

  • SSDEEP

    192:P51E/Nv/s2CG85Y1aPhTjF+fNn1cZT5Bpf7ACVC6Tiz+9gWv5hkUyVoCZVmYl:P51E/Nv/s2CG85Y1aPhTjF+fNn1cZT5o

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2