Extracted

• • Target

    DHL DOCs DRAFT HBL.pdf.exe

  • Size

    1.1MB

  • MD5

    6992b405b10dbf2bc8a90a12173b57da

  • SHA1

    9f59faf24d451b068e1b02ad3c63577f635e81dc

  • SHA256

    fb9e0b4298f1727f9be78e30fed5916dc226491d46b12d69b3321b77b9a22445

  • SHA512

    ce74d7344c7c33abcdef8b85b5699b70a229aedec8aef66db193e0280076e9594f542768b7ef6197e9bcccfc58b935b27679df995c7e7f4c8e2a03b50429fa3c

  • SSDEEP

    24576:Au6J33O0c+JY5UZ+XC0kGso6FaDxKYQkdij5TSqWY:qu0c++OCvkGs9FaDoYQkd4TmY

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2