Extracted

• • Target
    RFQ-SHRS(E-5274)-DDG082.jse
  • Size 359KB
  • SHA256 3b366ac5bae87508a67dc2a4c6c452aecc6e3af54210eef77f9d9d1a3d18a9ed
  • MD5 e702e8163c3924f4bbbe20118b64a62a
  • SHA1 292f8eb1157ebba294d4cfc2e603689701022ccf
  • SHA512 4119e5decd184fafe07cfc407fc722f595cc06cd44827510bdeb7867d559ea1986a3d6529ecf01e6864ba75e9164a8e9283dd4b4426f3384f248678b466c372b
  • SSDEEP 6144:l2F3gXZkekZLcRxugAClDa73mU476692uOSvlOl27jvVj3M1y31tzN2:2CAgA2G73mU4LBjvd81O1tzw
  • TLSH
    T12C7430842AD1B4940B479B7A3B7BB1D6F43F0CD966E40406F218F8B7F565B06EAE1630
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2