a9a3a42dac1c522ca696c84f1ef123ecbf80618da9f6e7975c0cf26a09d1c064

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice.pdf.js
Size 725B
Sample260808-mw8fesda97
SHA256 a9a3a42dac1c522ca696c84f1ef123ecbf80618da9f6e7975c0cf26a09d1c064
MD5 1bf14e8af9f1aa3e7777ab5d20bfc37a
SHA1 ae77bf7bff4b23f3992344a730aafdbf30bdf01e
SHA512 074ffa39341d3fff23d15a0289abe14decc618acbc4de94505ae49b4dc81b652f964a2f51751d17bcffde47319e30c0b2de0482f8f612b9dc3359633b55c5d87
TLSH
T1DF0124398204D8C4262A56C6D559CB298FA62D353F02F7677C5DCCE036DE0258D195DB
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4492	wscript.exe
5	4492	wscript.exe
8	4492	wscript.exe
9	4492	wscript.exe
10	4492	wscript.exe
11	4492	wscript.exe
15	4492	wscript.exe
16	4492	wscript.exe

Deletes itself 1 IoCs

pid	Process
4492	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\invoice.pdf.js
1⤵
- Badlisted process makes network request
- Deletes itself
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

out.exe

Path C:\Users\Admin\AppData\Local\Temp\out.exe
Size 2KB
SHA256 ef05c7362020823ef6f02a9447a13360b447cce73b35bd5e14c5f0eb6242e767
MD5 593b557fbf0cc8276bd19585236cf1c2
SHA1 cbe582daa9ce842f84bb0bda42a7fb302d77637d
SHA512 6588f55f64feec4d372d5cd5891ff849abd1c0747ffd0e028e7f8a3cb8430d7257b8c6084d21dbc5c341e19f9fafeef6fa5f376aa732d60384ea122b9f0f625f
TLSH
T1F851F1623858D91C68E19573B8C17C605F92A2372F4DD8C094ABC13A2FD1BEA49027BE
MD5 SHA1 SHA512 TLSH

Submit Download