Extracted

• • Target
    Holiday_trip_site.js
  • Size 1.1MB
  • SHA256 cc9a9aeabf1702a9ea2775f5f6b4f8feef99f40fe54db013c3d783b2985dae8b
  • MD5 4d16e8168c71595c3ca7c7e87dafe2ee
  • SHA1 fe706a1cb77021f052f6b170aa48fdd3025c0ce9
  • SHA512 8b14e2577e9f7c84e0c8343ef036a435ea90d78da781b7faf39c1dab54ea4cfcb79c6f15134283c6f99634d5f79afb8ef682066073b6a7e367aad753cdf54aee
  • SSDEEP 96:WH9wCu9ikvQkdgLih4zfPnLiPWwxStgDs6kuNkTgLik4YwY/Z6hnNiTwQhZuGfZG:Qj
  • TLSH
    T1BF4501F525B59A8227F3F668FD5A21A58D04C33410A7D8146382CDEDF7A069C7FB093A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionobj3ctivitypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Obj3ctivity family

    obj3ctivity

  • Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2