General
- Target FACe_Notificacion #7E42JBQ16JZ7YUXYL9.PDF.zip
- Size 867KB
- Sample260722-tmpqaavwez
- SHA256 46f3889ff166d0a2b57a725cc30dbe660902d28e952c315c0055cc9c961b34bf
Score
10/10
Malware Config
Targets
-
- Target FACe_Notificacion #7E42JBQ16JZ7YUXYL9.PDF.zip
- Size 867KB
- SHA256 46f3889ff166d0a2b57a725cc30dbe660902d28e952c315c0055cc9c961b34bf
Score1/10 -
- Target FACe_Notificacion #7E42JBQ16JZ7YUXYL9.PDF.js
- Size 62.1MB
- SHA256 5c817c3e706bae973c0c8f0b348c3dc5eaf03af5795bf6a8ab5a53b8de451760
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Accesses Microsoft Outlook profiles
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of SetThreadContext