Extracted

• • Target
    dekont.pdf.vbs
  • Size 14.5MB
  • SHA256 959e842a149e5107ea007b3bf307cac4f03d235a220258f50a4d85e9f69be089
  • MD5 5b3453fc3901d3a9af523904e4786a09
  • SHA1 ffc95d86edd3636303ab0dfb73ffded4d5b3d96b
  • SHA512 989aa77173ee989e71c114378528a1b8cc9420ac4e926330a888282e2f7b7c15665da516faf47ee04af3602039d9d3b20544053baa7348207e71ffa27e7130eb
  • SSDEEP 768:TALpRVVM41qR+7qLfV4AanMA+jvfei7u475P0KsxMGc1VgPz5xmsYpBsa2YepPPo:RfPbjQkrEmD
  • TLSH
    T1E9E6DD68EA94B0C5FDBE848A9172C664C82DB3895936BFFC784D1C350116A5F163B33B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2