Extracted

• • Target
    Booking-302-100-475-pdf.scr
  • Size 746KB
  • SHA256 0593b9a2c09ed235e48ceb2b86b64feb9de1eaa58893af1dce532da959f27c69
  • MD5 dd335229ce9cfabb228576f4eb90bbba
  • SHA1 f9b20507daca9ab8c4f4006fcbae77251ab97deb
  • SHA512 43477a8a0937834b1ac4aa249f59f64f17d9b11afbca0be89303fa787b0f66ebc26e3f2ae9aaa4a34c1bd979af2410f8997bc21f2e1f2c9a09b3ee1bc534e514
  • SSDEEP 12288:r9C924e4koL3MpKy3OzQdyBxjbCFroh3l+C6E0+:r9CQ4FMKy3OzQdyXbCFQl+CN0+
  • TLSH
    T100F47C24B3F409A4F1FF9B75D4B18522CA71B84B9A34CB8F159885AE0E337919D34B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryspywarestealer

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2