Extracted

• • Target

    Ref#501032.vbe

  • Size

    10KB

  • MD5

    86ff8bd6d9735bf01c8f6189f4ad1002

  • SHA1

    d6c3a4c31b8be503380490454ff2e5d8a8d65d9e

  • SHA256

    31c409ec86ac6e73be5f6732ce850313111c9b41dafeb1a06e63e82c408da79d

  • SHA512

    b658e1764d8e42c3d670f22593bbb6ad9a5ef2177ba1668ee009859a80023718cc173d6b3a801198742f392170dddd4bd85fb94ef0cceec225b9d6c6557fb73f

  • SSDEEP

    192:9h1VLVXWk2P9VDxvTNjYAYFPKf7zXnGD7XbmcDXMpekKiK:jRWfPNxjYAy67zXnq3mJpG

  Score

  10^/10

  collectiondiscovery

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2