General
- Target Rekruteka_PL-OfertaPracy.doc
- Size 35KB
- Sample260720-gzbb7sgv6m
- SHA256 f7dd82797a4dc06bdbfe6e83abfba58faa8f2bb78a6c2afa84cb2e476d6b0f7d
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://rekruteka.pl/ThreatProvider/bot.php?__utma=65fc1c182650ce5#%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23
Targets
-
- Target Rekruteka_PL-OfertaPracy.doc
- Size 35KB
- SHA256 f7dd82797a4dc06bdbfe6e83abfba58faa8f2bb78a6c2afa84cb2e476d6b0f7d
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.