Extracted

• • Target

    COPIA_ANEXA_DOCUMENTO_DE_REPORTE_Y_NOTIFICACION_POR_SALDOS_PENDIENTES_DE_PAGO_CONCEPTO_OPERACIONES_MERCANTILES_DENTRO_DE_TERRITORIO_SIN_DECLARAR_PARA_REVISIONpdf.vbs

  • Size

    68KB

  • MD5

    943b9220d27c71f1f97524ea87db7ebd

  • SHA1

    d57a52c81bcff8ea2f4def7646aa9d4fb3dc9972

  • SHA256

    370e7db7155cd9b03875431462ffc8223dcc4bf7c1dcb5a07420e84bc6316d93

  • SHA512

    a6e66e74af19902ba71154a17f4625690638b57ba2fc419a19040bce1c5c3b81f64049687dd666d0471f6075675ad0c831ebedd8f0cfef1a6de28a65db9bff58

  • SSDEEP

    1536:bUJW4Wrle/PhG+/kery+bGNccc3gt5pzKUGwm:jS7rgt5p3Gwm

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2