Extracted

• • Target

    976e459097d02ba60e08c872cd4e997b8ffde163a3bd7bb4abef17d455b62ed8

  • Size

    54KB

  • MD5

    49e864fe28310b2adc782a975aaa5b67

  • SHA1

    82a9e71eccabf7675a333b9f4fdc99a85634bfbc

  • SHA256

    976e459097d02ba60e08c872cd4e997b8ffde163a3bd7bb4abef17d455b62ed8

  • SHA512

    381a1f47fe57a996fbaa56ee1b43b8260f7d3bbc9346be68114fe7977b283d0aa2d340291745d2683ca45a0e3232efbe644a5539f3756c28b24ba36cf63857ad

  • SSDEEP

    48:5Au412WV1OS11DJ1OS11Dn2nI25P1ZQOAQUt:5cp1np1gI2F1u/L

  Score

  3^/10
  behavioral1behavioral2

• • Target

    Revised Invoice #03252022.vbs

  • Size

    636B

  • MD5

    e0e7f44f32d0b3dabb08bd61a3b81f6a

  • SHA1

    3b5d3334936280cee7be949a7712669300502377

  • SHA256

    db00c50095732ed84821f321b813546431f298525fea8dbd1a4545c3abfa1fe1

  • SHA512

    78baf7107944bc1cc371f058f73a2ecd1f601b3401d10774440cfcbcc767549bb43143c261422e7bd2e3f345a5ebb99acda70ca1a2033ccbcd08ef86edff8bf1

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral3behavioral4