Extracted

• • Target

    PurchOrd_75238572.pdf.exe

  • Size

    413KB

  • MD5

    d5c543bf77e87e9bd24b882560519b9c

  • SHA1

    ca41c520aaf58651c8bf721d95882a98b54461d0

  • SHA256

    b0b57f31507dda8dd80282cb47f6b1e55bc6b2d03c6e76211a785e3b236cf418

  • SHA512

    f046fa47ec70c79cc5d8c05005e9a4b0d4efb7644488d12eced608855e0e33a7dafaaafb18d46f7eb9d9a710d3ad6ab5f128d927d72b8aa5ca66f7e45187c6b5

  • SSDEEP

    6144:WOxvzSk6LQTHLmKrw3X35vIl9V+F9EYfpH/w80iVjt38:W4vzSkN798Fh9Eq/uiVts

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2