Overview

overview

8

Static

static

1

TT COPY 50...pdf.js

windows10-2004-x64

8

TT COPY 50...pdf.js

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    15042026_1543_15042026_TT COPY 504522904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.txz
  • Size 116KB
  • Sample260415-s56wvaex5t
  • SHA256 2f9934a29efe97fc1da43d5a66745c915eac5d74d997c8a36ee72e18810eec1c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectiondiscoveryexecution

Malware Config

Targets

    • Target
      TT COPY 504522904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.js
    • Size 295KB
    • SHA256 64ac510610d6d88dc7783afae4683afca3cddfd9ec0216518d3190d9b926bb50
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    collectiondiscoveryexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks