Extracted

• • Target

    0x000300000000b3e3-94

  • Size

    194KB

  • MD5

    914253e6225b686ee3e0a752c1cd1bb4

  • SHA1

    42e9ae719f4dfd04e7dcb9d58a911eb37fd3439c

  • SHA256

    00f52a2f56551d868397acd11e4d12c353d7107ce680c6ff00012a90dabc818b

  • SHA512

    92ecf4249ef488d95a657a3e920316cc816e2e8d5d2b8e257e4ce074626beda95d379034c86758ac7a1623354cfe2cba14bf811f73f3a35fe97e3610d85c9e3b

  • SSDEEP

    3072:7tduXlp2G4E2A0w8Vf0DyQPrWDgt5pUGw1piL71OkHiMZzvcqgp3yO9pj2t7tK:JW2Gp9b8tPQPacR9vctpiO9pjGtK

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2