d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591

Analysis

max time kernel
108s
max time network
109s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
23/04/2025, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pleaseviewstampedimageandconfirmourorder_Doc12234567754_678787899 pdf.js
Size 2KB
Sample250423-tsk92ssvf1
SHA256 d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591
MD5 6d78f0fab6a63a45fecddfb6e6bc004f
SHA1 6435be9b85b5d3360e545f4a17d3754a61def53d
SHA512 9108c08addcd1b64a22f07765aa3cdaa96395cba21ca77b60c4a41487eeb11baf09019121c99ffaa7ef14b98e02ef558a54f2986b19e9a311e8104a8bfcc87c4
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	5516	wscript.exe
3	5516	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\pleaseviewstampedimageandconfirmourorder_Doc12234567754_678787899 pdf.js"
1⤵
- Blocklisted process makes network request
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads