Extracted

• • Target
    SCAN 654HG - TYS SG _ pdf.JS.js
  • Size 3.5MB
  • SHA256 288e9320f7582f388ffdd93f00efebf60bf95e672804dc703da00eac890cb661
  • MD5 c9ab236271394c8b3ea54b7f40a29af7
  • SHA1 6e798555e80ede933c02a4280a6f7934b6406de3
  • SHA512 93b5105ff37a5013c0d5d37c0f5ffb5cfaa0735dd5f682ad6c3d0dcc4f8b6cfa401c6de0e4f3c4862a549c5b39e81f9c0842235e68b03b09403c8f2b8ed499f9
  • SSDEEP 98304:BEKgUB1QmOOPqxkfhhCpe3xGmFON1430XwhoBy:Emok5xGm64L
  • TLSH
    T11F06A5D00745967152AEE31CC6733110D62E20476296EFAF32E6067CB6B1E73A3CA5E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderformbookxwormloaderpersistenceratspywarestealertrojancollection

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2