58ee679b97d9a057a421bd0932b570adf84c73d8ebb76d423e4e8ead0eba08f4

Analysis

max time kernel
298s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 05:09

Target
PO N26000232_pdf .js
Size 19KB
Sample260517-ftam2scv31
SHA256 58ee679b97d9a057a421bd0932b570adf84c73d8ebb76d423e4e8ead0eba08f4
MD5 fc9178ca13302cdc3a083651f7f3c57b
SHA1 1e67d8328d1af2000a032f597658b5784a6e8c42
SHA512 c6d8176ffe3e8ae6ada0dc80c61a572832265ab5e671b5503fc6e3653e5961b364e718df7fc1a12718286950e152055a64798e90401133637b304261114b2af3
SSDEEP 384:ACo+QmUy+dVq9+uUfp+YweBJshOuonnr4m55y8tr:ACoyn+CZUfMYweBJDhnZ
TLSH
T1939230CD39C2B59087A2746B2A7FB59EF27F0C80790CD054DBA7A085B878B18C9F156C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N26000232_pdf .js"
1⤵
- Badlisted process makes network request
PID:1732

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact