Extracted

• • Target
    Claim Documents.js
  • Size 1.1MB
  • SHA256 329b9cfcc633c230f6892141c6a5c584cd1a24d389a495766ff3c93b152451b5
  • MD5 f208f2c5ed2693051e840ac2028496fc
  • SHA1 06cdf5c0c01d7f4c362380e397c90818a078c8dd
  • SHA512 6525659d88370c74573ef0400c63c257d4ff561a268dfab91bf0775d154c185efee9281b7b0b0b29f801f24ba36fd70aa7c0779e8956c8be209bfb719f99a6a0
  • SSDEEP 768:lvJC2vkvmCT8+T8XC2vAvFT82vJvmvmvmvavmvYT8+T8XC2vdC2vAv1vJC2vmvdZ:jB
  • TLSH
    T1C3353F520E43EE03C4ADDAA3DD14C0DCA7B1791AAC8DD226F662CAC8509175CDE9EF71
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationpyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2