Extracted

• • Target

    Company profile.js

  • Size

    318KB

  • MD5

    bfa7d7d0e050ee48b84f4aba3b888e47

  • SHA1

    5ff67abc444b37f7480f06679e3dd2ffd852c1f8

  • SHA256

    8bd71b8a951a759139aaa5b65632121142d0a2e2fd715a961aa86f424468f384

  • SHA512

    394b0fc2866d87c97fbfc9f6a8900caa262be71c605bd60df8c6f286f839322c43952cdef4b54867e2c3d21d134789e46d951bfcafc80d5bb62f21bf2391286e

  • SSDEEP

    6144:B9jX2SizvvA5/6uuazcYJYD9Onbtc46BBYczl+GHbxAM2vaLkqN/su0KMb4kGrPt:/T2Ssv45/6udzNC9Ubh6ow+GdAfvEkGz

  Score

  10^/10

  executionobj3ctivitycollectiondiscoverypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2