Extracted

• • Target

    DHL_Shipping_Invoices_Awb_0000000.vbs

  • Size

    544KB

  • MD5

    f757be4bc8889174f9c6c45d6302e00d

  • SHA1

    07028abbc63ce0ab275c0b495451c38c3f686358

  • SHA256

    42f3a74c4a534ce4ac65b5e14474a905e8fbdcab70cc6d330ef763062b80a2a4

  • SHA512

    8420a5fd3bc27a7ce403b989db088e40d1fdd7a8010159d9e3973160719dc0e32bc31500dc98d3a8ea020138f888d2a5013d7f57f0668b94cbf46b46de15a130

  • SSDEEP

    1536:155555555555555555bMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMg:A

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2