Extracted

• • Target
    Proforma Invoice.Izh.js
  • Size 1.9MB
  • SHA256 bbd75c851b563e3882d7ce47253ed0c5310af70c587e5d0a259d5ce095b33041
  • MD5 2182c71fccec6841386cb42a3cd00790
  • SHA1 0f64ad0193d490d1efdead017d5bdbbd317f873c
  • SHA512 7523c2ada29e5e4c9ec2a76995fdab21c55da2b3bd95e6c62ae8ae6a7fcaf39f5a8d6b5895f21497cb7436bd9f8f39573abde18894717fa9e9c79798751a129e
  • SSDEEP 3072:yV4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V4V45:d
  • TLSH
    T11C9512B083E5A1F696F003F1A8148E2CFAB5E59E0D2A739F7357B8CEA95F3150185D60
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2