Extracted

Extracted

• • Target
    Proforma Invoice against PO No. 1P00034712....Pdf.JS
  • Size 9.2MB
  • SHA256 b139f86119784e3a5f2aac3d2c6beeeeca25b8654ba6fb4ffecab85a6d74ad18
  • MD5 4def590d671b15fe201b47f542c3fc24
  • SHA1 062add02e09ca64a0fd59bff1838a64a2b02b73e
  • SHA512 e3bacaf08022ae2889c709299e5933c05dad4484f1d0e59cef0a236145e16137bb4723e952f6dbcb95dd1bd2da628f947fa825414ab358af23e98fdad1f3f7ce
  • SSDEEP 196608:LQ6ALZfHpN5Uv92y4QvSojUo6cWd8Gh7kBKN8v/FZcgGMhSigQc9NdglU0KqifKE:0yqob6hdpqoN8nLXGMBgl7CUpqO9ifsj
  • TLSH
    T124A6F7A21354923137A1FB8C837AEDA1A55E524B05CECB2531ADC54D7B3CE0B73887E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2