Extracted

• • Target

    Ad090512515541511555,PDF.vbs

  • Size

    14.3MB

  • MD5

    5565dd9e27b8d9d3f2c22656193a6a1c

  • SHA1

    f41e89954e0dab2bd7139d5b89a2f80060487a17

  • SHA256

    ec3753896e7a796986bdb9533cfb19481dd02e454fafad31c3c0f026da895afd

  • SHA512

    966ad4fd2fcdcd1bd701a22a391db1ca8beb2af7309cbd49bdf0608b880bbfce3c03f83e9a9342af656d69fe1830526a4118491f83b927a6b34550a96e636f78

  • SSDEEP

    1536:lyyyyyyyyyyyyyyyyyyyyyyyryyyyyyyyyyyyyyyyyyyyyyycyyyyyyyyyyyyyyD:2Z5b

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2