Extracted

• • Target
    Advance_Payment_Receipt_PO-2510-00067_pdf.js
  • Size 1013KB
  • SHA256 934228a71cc2d57fc6aeac4d1c5eaac8abf665044c45829732e398a7aa3e0d3f
  • MD5 71e8b47af733ca3731ae0c4188a6bf32
  • SHA1 f024145ed3bd87e46f29d546a6b96661a349aac4
  • SHA512 408de49035b853f24c4508551efd1abb62c99453c52b0dac190ac4e7506be4161f538658bfe870355ceea5088826340744e1d1eb80d2572b7f5c29ffe8ce031f
  • SSDEEP 6144:wfYcJfYlf+fYBfYgFfJfYcRfY2fYyfuQHfnfY3fXfYrfYcSfWfY6fYuf/fYUfSfa:bFT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwarecollectiondiscoveryexecutionphantomstealerpersistencespyware

  • Phantomstealer family

    phantomstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2