Extracted

• • Target
    Fedex_Shipment_Notice_372609808177_PDF.js
  • Size 1001KB
  • SHA256 22b73e8359df7ff75af4b2bd468a093f2e08f8ba71e404276c1a3e8d6049a753
  • MD5 5ae8718d226b2d261bf4a18aa3b1295c
  • SHA1 83d14ac53c181d7c989d46dabee3dac6c4d1fc8f
  • SHA512 ed29e542c2b078df854f396dc0924beb6f473996d78d6578997f190a31075002c1ae63e8e0d4c060aa6dc9bb81c1b0e70ee5b9984ae204867baadf6fcd02b719
  • SSDEEP 768:UoV66qim7XRVsim7pbX7XJVm8sQX31qi9YJxeJxiUbbX7c898UxeRysbpbX7cDs2:7MRIH
  • TLSH
    T1D32541F29EE7ED00EA8DBF53AD100D5D85DA206BEA10444F3139BDF1493192BE4997B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  1111111executionremcospersistenceprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral1behavioral2