Extracted

• • Target
    20-07-2026 Tarihli Dekont PDF.js
  • Size 2.0MB
  • SHA256 d08dedec567306066d4dbbd26a11e862dd96c5beb6475d8b0a434e2eb63aa2cc
  • MD5 a18633f19697868f264baed6a589763f
  • SHA1 7b640ac29093ebbab7b3d7dbeac4539f0e3c43cd
  • SHA512 2c41914bdd6a3a0b268f362a97c9fd3120b4197ba5bf0b631bc7e15723a13fc9b9ab29c7854ff6e5936cf6e8e193d10e99001bada584f17e754270856a23cd60
  • SSDEEP 192:k80LhBt1e1aMb08En+qmb8GbBdDr0s0KdCcm:k8015gKi8CvKGXm
  • TLSH
    T126A57BFFBFC906163392210EED413628D37C664E25F7411AF12999AFF3D9C48496BA24
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2