Extracted

• • Target

    Purchase-Order.js

  • Size

    84KB

  • MD5

    9365654ecf8a7829f0aa2d2b7d23ac34

  • SHA1

    15f1d26d2c8298369f443398776ec2c7a60e6b22

  • SHA256

    66a3a1836b0bf490bdcc66ff8bab7fc9ff210bbd646f1191d565f0d59be5cb1e

  • SHA512

    f83d089d465c2f30bc233e6ec835455a9761f325bd74b97b50d9f15e9e554c88c8129bf978cfa4fe9faf1c4d60b661dc2e782503aaa88a596153aa66ddff16ef

  • SSDEEP

    384:HZB5abmZB5abtZB5abdZB5abNZB5abtZB5abdZB5ab8ZB5abtZB5abdZB5ab+ZBc:TD

  Score

  10^/10

  executionobj3ctivitycollectiondiscoverypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Obj3ctivity family

    obj3ctivity

  • Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2