Extracted

• • Target
    David_Jones_2025_Tax_Documents.pdf.js
  • Size 22.9MB
  • SHA256 f251d75cbea7ce997ba95ced1af1b852180a7e3c276e8984b0ba5c6234b7390d
  • MD5 b9455c087b3e05fc8c59e2ff51ef41b6
  • SHA1 ae018f562f77602ea6aba59b6f380721ad8ec973
  • SHA512 70b4d3e504b9556a15309447100e85933edc1b8c254faef1e0d76699ee75421e622febd8ff70e83bd3c44e0e99f24885e5f7d334fb70971faee94eadc2d600b5
  • SSDEEP 49152:qls5lsTlsJlsYls9ls1lsklsjlsvlsolsAls+lsglstlsHlsHlsals8lsWlsglsK:W
  • TLSH
    T16637132F193B4DB6EBB91C095DBB56DA3C5D5C80C8ACB2E1D3E9BE24DBC9704204D684
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionoverlordpersistenceratspywareupx

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2