General
- Target 04062026_0251_03062026_Remittance_Advice_50percent_Payment.pdf.txz
- Size 105KB
- Sample260604-db677aat5m
- SHA256 69dfb93e9eeb68ff20911585407410ae726440f2539609ecab780ad2d915eda1
Score
8/10
Malware Config
Targets
-
- Target Remittance_Advice_50percent_Payment.js
- Size 791KB
- SHA256 b95012a5ed4784b632680ca3291db8dd17908c5137279e190a06563cd111665f
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Registers new Windows logon scripts automatically executed at logon.
Accesses Microsoft Outlook profiles
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.