Extracted

• • Target
    PO-02.js
  • Size 1.0MB
  • SHA256 c60d2d3816f5dea41085f4a2caad8b0a9875b9550fe9cf2ceb44e4bf296be890
  • MD5 395c28f81836e82af854d9f5e69f9eaf
  • SHA1 b140aa7a44d1cb03facf2c4479697925bb8c44d2
  • SHA512 9b88aa0daaa0bd6a2a9557713b70b3bcb67e1a460d8d5eb0160308018616748ee41d2014eb78a7d1e54da7611695aa57d3426c1eee01f701fbea69e37160799a
  • SSDEEP 768:cNSUYhhvdeehypxK++fhhVIh3pwNhAx4anhWJ4EqSDhhah43hG5MCOI4K6+h3hRk:grq
  • TLSH
    T14B35777F966838A3CEFE151DE99E1D1AB321056DC17F1D8F3826A2B82D5E44493E3438
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2