General
- Target PO_148905_RFQ_Documents.rar
- Size 1.9MB
- Sample260722-h2w75aca78
- SHA256 8fdc1f22e1a2eb49ead5ae2f72ae6e69232c747f2b8a28aec02ece15998024b4
Score
10/10
Malware Config
Targets
-
- Target PO_148905_RFQ_Documents.rar
- Size 1.9MB
- SHA256 8fdc1f22e1a2eb49ead5ae2f72ae6e69232c747f2b8a28aec02ece15998024b4
Score1/10 -
- Target Commercial Registration Certificate English.pdf
- Size 975KB
- SHA256 2ba2dadfdb7b23851748579b835e11d5180c291cd6ad4dad6e179ee7fd57ae1e
Score3/10 -
- Target Drawing.pdf
- Size 4KB
- SHA256 7b2c2fd0e3e104f8c106b0422b0a8b9969c1db058b7a8b4ea444a8363fcca40a
Score3/10 -
- Target PO_148905.js
- Size 6.2MB
- SHA256 cc8f08aedd53167106628cc084ce38ab1532c025115696b00b7e51bb90128ddb
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.