Extracted

• • Target
    FanSport - Billing Report.js
  • Size 200KB
  • SHA256 d4d01360b6cf5992b1145528842e9a3214a24faebfb12a2b33731f5d0cbd9771
  • MD5 43cc5e5ce5ce3fbe44b251bacc672b5b
  • SHA1 6a9e92a2bce36b51df2ed44fcf5ea3f455967db3
  • SHA512 5e2414d3f279c4d61ade37fa62e69bb64a9a701f1a90c2d2fbcaf7d5820e6c1d8ed23b1438bcf84a9634d10389501b4f1acbaddad3897bdf4779d0c1193bd17e
  • SSDEEP 768:JZSzirsaioDtwPUPFPDgUrcJa3MO3SU+K/OaLzLVyKsWqf/znUTETzgcckR:W
  • TLSH
    T1341472BFF06388E3D1CD4573CC2721AE26B254DE1D34AE2D1194F9D89CA6A5B09E7D20
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutioninstallerpersistencespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2