Extracted

• • Target

    PURCHASE ORDER.js

  • Size

    319KB

  • MD5

    e8114157714655fdbc7b51cde4f676de

  • SHA1

    c23a2b3c76b2b7927f64cf74c3cf75b408a629e4

  • SHA256

    d20d1cb56afa7818be3b26074bed7eae73e5480a5a8e0add5384bc9eddbc333d

  • SHA512

    9f33a77504f56f4b0bce859d3b61f81cf3496a00d6cfd3aaef708f700149c72f1fb009f15e720a59b013a443c15b3c68a621358c624138b72f3409db53692c8b

  • SSDEEP

    6144:1m06WlUzat6poIKNrZUG8IyWwmRn+CvA1HPucBzprZa8qYlVLY8/1PcKpOu4:w06WF6poIKN9UGDykRn+gA1HPu4zpNar

  Score

  10^/10

  executioncollectioncredential_accessdiscoverypersistenceprivilege_escalationstealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2