Extracted

• • Target

    Documento.PDF.js

  • Size

    673KB

  • MD5

    6cfadcba2b7a883a4466a8def0e2b446

  • SHA1

    f2680fb39456133b5e034a8642d32c0682ee5f1f

  • SHA256

    85e41bab0ec97c8110d96123d9c0d0c3431dbe4b388f5695baf5221e9d736718

  • SHA512

    d0ca442e9b56a4cad02d51320d63c193c54c7ee1c9aa6146a0ca099d31cebacf70878142cc140244b38b58122f6da577888310ce236cb3db142b2550eeedaa64

  • SSDEEP

    1536:lRxRZ4C5xLSYmOL0hQr8uz3PdkLjNrHBbNHSNL9UL5KT6nsQjkB:h3PdkLjNrhbNHSNLEsYE

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2