Extracted

• • Target

    ODEME.01.28.2025(57KB).pdf.exe

  • Size

    823KB

  • MD5

    08df52a7ad901e5f5ce650684ff6ceef

  • SHA1

    2f794358f6561b2a4e763f0c3056f2f7a1eb6d1b

  • SHA256

    b46763d2b9f60018e00a5f4dc77951787ac58ee8e85973b779b1b01b3056c126

  • SHA512

    049ec2f9b29dbe4427ac7d70637eb397bfc28b19e71f7db6975e6aa8708dd11aa15bc039a04e6ce016814f614a17c6b52dbfc572f5c21c9282b14009098b474c

  • SSDEEP

    12288:HrlY00jXYd1rn1jldZC3ThHVBbIxpOPRAXC4z28O9MWEYD0CCkUWkG2DtKotZtg6:HrldTrR01V9Ie5gCo3BCnDWZKotZy6

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2