Extracted

• • Target
    Pay Advice-0000121258.js
  • Size 1.6MB
  • SHA256 429db8441c18dc12f7c74262f4fe362e5c1f992008030f96896e8978e17a270e
  • MD5 e3f3f8097a1bbbdf6e0703773858fb12
  • SHA1 fccbc345ed80d66528d5b94a0ba5f2647806271d
  • SHA512 3c1318a158ccd3804ddc86750b08fe0a30a178704d819c96a35e25afc6510d61b2a88908fba52c6df162245e5522c245644f7dc5b5956895482cc35904180291
  • SSDEEP 96:NHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP8gmHP1:vjznbD/VRqFjnFXhFSezXJS4PwGRu9
  • TLSH
    T127857CB7AF9C322C41AA41462B5B1FDBB976B411351A81BCA3E6E0472EF1C91D24583F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpyinstallerratspywarestealertrojanupxcollection

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2