Extracted

• • Target

    awb_shipping_doc_001700720242247820020031808174CN18003170072024_00000000pdf.js

  • Size

    120KB

  • MD5

    eb782feae7eeb73bcc5976e0cddb0ec3

  • SHA1

    fe5d2b6873f3a39579faabf4711599b480c4581e

  • SHA256

    8e3e8c8c3d07894e248403085805acf867292cf7737392b3b9b2556e50ff8478

  • SHA512

    2e3612042911da5c570417af86ff47472ec58453ccb1d9c03b9bb9b5f5326124ecb0bd5bcb963480dfac171c3ae9820b8f9cfbddb601d9352a3ac18340dc3de6

  • SSDEEP

    1536:5dgBlOFpdq7MkzYWELraVId79UuxMoMxMUOIVSq41M2tNsbKEfZ1nzos:+YFp0w2

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2