General
- Target 24062026_1757_24062026_Payment_Invoice_Swift_pdf.rar
- Size 204KB
- Sample260624-wj4fdaes4r
- SHA256 a34abbb941337fa1c4a19846b6656368e33c1bc050317ec0a5702e4881bcc131
Score
10/10
Malware Config
Targets
-
- Target Payment_Invoice_Swift_pdf.js
- Size 1.5MB
- SHA256 2882e8c9aba470c81dee9b361b5cbbf9a56819774682c68a5c78af90f1bd23e1
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Registers new Windows logon scripts automatically executed at logon.