Extracted

• • Target
    AWB DHL 7214306201.js
  • Size 185KB
  • SHA256 9eee104aa1ddc7ab9a4a2e1a9f6020bd01d0f19bfcbeddbae332b1f9b4439c64
  • MD5 575c437ca7e7be6a92c281f0ba0794c6
  • SHA1 87f1474dba664a62b966f79cddcc6d6f08560de6
  • SHA512 2c45f8526439a24ac358567902eaeb7a9e9833bad1b3d30f5dee9c499dc654a3ed7068ba7c92ff06236507546c482def4509d71b8625b2fa60b29d9de8f04aa1
  • SSDEEP 3072:8orDZWkTIKg8IC5Khaz9cOyyiBMFhPTF6dFArrXl02QQPgNUUOrmO7VPb+dIE/tn:tDFIKLF5px6d+rrXl02QQPgNUUOrmO7u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2