Extracted

• • Target

    Tools-Invoice.pdf.exe

  • Size

    272.0MB

  • MD5

    994aae548a9f407ae1784e973ad94693

  • SHA1

    08cb87669814ea1848cef750c75a39cd37cc61bf

  • SHA256

    1afc90c1b93eeb299b87b505112b345a64b07e91b0f1e6306a9c2ece7c7feae3

  • SHA512

    ed7fbe45a6d89883cc733899691c4f621f5980bbd4feabfdf2d06a902c250f1ba4c6293d216ff8f76927f2007ebcddf62456a1ac7bba02591972c980a5b6de88

  • SSDEEP

    49152:Uj+t6IRUEFX1PVv3Gfbs8HuQq1nvHol6Kz3DfjkJ:Uj+tNtV/AAFBH9yzL

  Score

  10^/10

  jupyterbackdoorstealertrojan

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2