Extracted

• • Target
    REQUEST FOR QUOTATION #4874903039.js
  • Size 2.0MB
  • SHA256 cc4af2fdaf3844b3f005486b3d9a6cec3fcf9a0384537ff4151d3aa76257acf1
  • MD5 cb3ef71717f870398cb66d18be752719
  • SHA1 e76304d376bd27d0412fe6ee0c46a2abe3f00c45
  • SHA512 f8a4ddb663017cff4af4e59935a2cc2c645f905d1a00b8de13d7eb6b4d96a992f11b90b01bf79902f3165a8616599356b6b3d4bc2e3313c822dffebbd34c593b
  • SSDEEP 96:KfuYo5ZRTZ4Z545gGVWAx9p87BHCWe82/hJ5EcIlpeE4wqxMO0C4Ya3SVW:YuYgZX4O3xY7BHWV5wqxL4Yi
  • TLSH
    T15E958EF0A2772CC52AB6B570FD48814AEE13E97D2DF71D96F607045E248518A02DEE37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  monexecutionremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2