Extracted

• • Target
    invoice-1645080830.pdf .js
  • Size 23.7MB
  • SHA256 1ad06009560916080ac44a3287f65a8688846f5d48670e058c4f9139b00df98e
  • MD5 f08971d078304ce98957c50831b0d15f
  • SHA1 37220a8dbfa25b02180947be633adea41e15d319
  • SHA512 447ce90ce86d7a6f0227c283fe1f667ac55a8b99c46e1c34c96bedf19efc5a1fc6ff6daf52f55032709aa1256e1576eda0175b967c402d1c3e2f8339a81a44a0
  • SSDEEP 49152:JekJQekJiekJRekJUekJIekJNekJ7ekJlekJ+ekJxekJgekJlekJ8ekJaekJ4ekE:t
  • TLSH
    T1544723030E0D2D5D8C3E3368CCAF1A5B569D8F911856D86297D2E6A9FBCBB44307C52E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionoverlordpersistenceratspywareupx

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2