Extracted

• • Target

    P_Invoice_01833-pdf.exe

  • Size

    322KB

  • MD5

    276cdadf22ef7203d0b03f5133bdb0c8

  • SHA1

    83ff2e02c8f7e38ae4f2241dc0af3cb15af30d38

  • SHA256

    6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65

  • SHA512

    35dde2bdea50e5d9de9c818afab1c34ed19612c6fb87591ac3ad73bf0dd9a9082ecb65b24fd2cf964d708a5f81e664072e5a9e3695f586859c3bb8ae946752db

  • SSDEEP

    3072:239RyRxwOaoKNaV2gukAY4Y/wMPW3dPVjg5k/rTI/VHWL:tyWmPqi/PI1

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2