Extracted

• • Target
    payment instruction.987976.pdf.chm
  • Size 10KB
  • SHA256 cf1ffcc75797d37517450cbd5ecb9550ebff74a12a48ba2d0e15983a789215fb
  • MD5 777de47d6b050f35804f0ab3800b5022
  • SHA1 b79e70226a6684c8c578e096731c9d8014a66485
  • SHA512 4797302886e082f713311e3c9c568fd9f5db44b307c5fe1cd8416df22819fd178c3c1ac7a74691b09e892da13b4beae893fb3e2ebe1039659c99517a443accf6
  • SSDEEP 48:f1QmDgKkXQ0M1QRlEFlErlElPVM5s7Lns9gf8K5hhVUKeZjOniS32rpT0ntxj8jC:f6mdNMInsmjWfjjS380j8jQZ4qTn1b
  • TLSH
    T1AF322BF073401934DA9A8A355FC7D057A1203F886E348E663195FB6F1EBAC6E4B508A9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2