Extracted

• • Target

    REQUEST FOR QUOTATION.js

  • Size

    318KB

  • MD5

    08dab38ef2c8bdada3b4928145b777f7

  • SHA1

    8d9fe403c417c9fc50ed09528dd2b096ebfe6375

  • SHA256

    cfea01473114d986467817f9c5e0713e84ef8d6fa8a44509780d390fc6b09b41

  • SHA512

    52aeb79f20660946bb7095addb26de8f115d29c4b15cd8169418d73db102c4ca7f79096780baa896357efe40999957969631b718557fd7c35e7375a2288ea5d5

  • SSDEEP

    6144:ae3G0HrhDz6LXUo09qGOWIC5pbyo68vh146TIVdDfo+IitZsVAsuG7EEqZ1Cr81b:Zr81VpOhEUX7dyIUwRjsSXKs0AUUbPMz

  Score

  10^/10

  executionobj3ctivitycollectiondiscoverypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2