Extracted

• • Target

    order.js

  • Size

    213.4MB

  • MD5

    6376d68402f9701827b296b0e32687ac

  • SHA1

    e68a2738ae999a0bbac2cff1148b43ef2a6ff372

  • SHA256

    8e04f169d134b85055a7dfabd827c30bd12de4e9cda62556066d33a31ef7c258

  • SHA512

    4cdeeccbba4d4df7bfd434b9fa2fa0af4bfd0109ea3030f56fa3ca59e5f81d841b6d6bfcfe225cea65cc3c3b3e88793a759e667014943a0f19dbeb1f18c863c4

  • SSDEEP

    3072:40PrWZtMkfiM6A2fTFwoqEdKi38VDf00PrWZtMkfiM6A:4HtMRAgJPK/f0HtMRA

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2