Extracted

• • Target
    LOA-AD-142026944-7K.Rivera.pdf
  • Size 846B
  • SHA256 91a28b65e3274b27babb6c306959ed92ac92c0c9ff7e88aca4d793d32a008098
  • MD5 cff4fa3884abd569d14b849b779dc3c3
  • SHA1 48957479291202ede1416fb340da862a53abb32c
  • SHA512 321003937a4856bb170cfedf16b00d3b36c3dddd9e6b6e5b511ce05b2491dfa8cac44ed95452cb5e189b8c6b4f8a9ca27fce41ab859e522d01794d1f7cc962b1
  • TLSH
    T1C2018E50DACE1CCCE52297877F26754B2DADF21216CCE1D220BDD78781C1F1AD647522
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    Order X3000 DD-1349.js
  • Size 1.3MB
  • SHA256 dc175fd1a309ff7d508c2695694b8da0ab2661c386b6cfce14d9949b3a7a59a4
  • MD5 0785177ffc33040e22b6d693f9c31cd9
  • SHA1 d1f65ffc85ed27b024848b823653b8d8273fa4a6
  • SHA512 d450206ec2da624971cdfbf23ebbb5145c6031c980414c7c66895a3e4d3b47f1023bf6c637caa947d756d9d80e7734f2ea35975ef41f925dad1721859180e042
  • SSDEEP 24576:6mIedlCfbLMRvnzLIiRelCoQctXmIedlCfbLMRvnzLIiRelCoQcm:FL9RvnzLIiRelCoFgL9RvnzLIiRelCoI
  • TLSH
    T101556DA626DF3C86091433696A0D4A480F0FE9760AC3398DB0CF1AD4975F4E766F85BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4