Extracted

• • Target

    ORDER-241091799.PDF.js

  • Size

    7KB

  • MD5

    e1daa8253602476d0ddd51e91e406a1a

  • SHA1

    10b0e9306019e58356a38074e609da3040da6641

  • SHA256

    4126a6f8a65fdb58a76b7af70974711560c58943c16466666cd8099ba2d117ac

  • SHA512

    70687606118a4599da950600ef7529c9c941c1ce524104512c8e3c852d1f81ab40710c1f4df6f4e3f95da01e8da9c2f35d6658f706667b55c4d4a817d32e7c3c

  • SSDEEP

    96:BmbAkRJ1vz3bYLEGU37ybeCwLHtYFCbvA:BmbAkRJ1vTbYLEGo7ybeCwLHmFCbvA

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2