Extracted

• • Target

    Documents.js

  • Size

    400.0MB

  • MD5

    647813cf3cca40181f8330cec1ee80df

  • SHA1

    ca602c6199ffe426328e277a05dc849a574be41b

  • SHA256

    1f75d59616e804ffbe35de4e67a33db2c58c55da59d4302f818a53f4d6d1b9c9

  • SHA512

    acf4bb9d182f41185a86c36c630d273716041f974c6cf5c36dae4ebfe434369220474f38c483cdfbac6f8171980931f976330ee8d9be7d76c2976f5b45becbc8

  • SSDEEP

    3072:kE2dapfO3R9u2rWy5ei4uzUuHUdTxcE2dapfO3R9u2rWy5e:kE5pkbuK8ErkcE5pkbuK8

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2