Extracted

• • Target
    PO-1400083954 pdf.JS
  • Size 4.0MB
  • SHA256 1a6eaebdcc55c0ea88201ac996c3bca4a2d099aa52cd9c7d148f25539ac873bf
  • MD5 f37b9103ae391a29d63edec8abbb4279
  • SHA1 3ead03dbe64121487f77f0a4c3bb1c14f4b8e5d4
  • SHA512 4240f9f4750305f91d2999bcd4ba8d887dfb567804c8254617f60893e1160d1bd7dcc7280e4e542374994156f289e268657e1788347a89fb4040097e6bdc307d
  • SSDEEP 98304:fanFWPNn2bYlM+Ojev70w7g77OzbcLCXtQIvx/E5sQmJyzlanFWPNn2bYlM+Ojei:JHiivgogSI0Cog7HiivgogSE
  • TLSH
    T1CD1619609618B570A93DE32DD03B6F29090DE00B7159EF1E39BD0A58B6B2F53634D9E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2