Extracted

Extracted

• • Target
    SKM08092026_076567.PDF.js
  • Size 1.1MB
  • SHA256 a99039b4ba0da4c05516d43a10dbccc34757b1e3c7b9de7a67d35d667b19948b
  • MD5 a64c9c09df4ad4310a2ad06a6b4ae2f2
  • SHA1 73cf6ba7daf8aad1ff29decbacfea947cb6a0d63
  • SHA512 698837fde3a0203eebb2c4cf98c0ba9c6031a42a0be349347333a1aa3fdc13cb34503fc87abad6cb88f8781176c60e5bf286245a86f3683a76390a9568fed241
  • SSDEEP 96:xU3Ah3AahvRHaYB3AYBHYq3AGvRHGvRXvRHamAeRvRvR3AeRvRUUHmAYlRU3AhHN:1qDxsDvlNDNQnW7L/6OetUUiJiaZ
  • TLSH
    T1F33559DF21634A75EC2E6099BC5781446AB28059D5789CDE332DF2788FD1E2A4383C7E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareremotehostcollectiondefense_evasiondiscoveryexecutionremcospersistenceratspywaretrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2