Extracted

• • Target
    Payment receipt.js
  • Size 1.1MB
  • SHA256 2cdd19401871a2df25db8ff23f8f60f35747cae5442155277ca948f860340c19
  • MD5 19840bc16e1cf295eb71501b7b3f6c08
  • SHA1 b3715636f6fe69356cad16b7d105fdd228946ef5
  • SHA512 8d4e795f86568a1a918a3e777b0245017e2f8913c8d023daff402766000bd9e8bc7a6188dfc0cbb334b5cacbf3382479d5243e5f1d86212a63d6d5f61f018dc1
  • SSDEEP 768:rAi5nFiietiini1asn3sjidSkqCcVigahsifsq+Byji9s1DB/tibwsUOqmW2Qin2:Q4V6nyeKyTyPoQTzCVaXO1aXkupiLSEO
  • TLSH
    T12335D81DF21A316843E0C26CABC585FD722F0BEA57751D9F78A980FED053940399CADA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2