Extracted

• • Target
    PO-02.js
  • Size 948KB
  • SHA256 89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818
  • MD5 ca50c98a451ba6c633b9d7e4aa5c8ea3
  • SHA1 0bfc3292b5bc730871aa32e56677f3a5146cf2a0
  • SHA512 2e597f6b398d0ea97d627b29d41acb359d7e89d0aaca0601a1c1135e8419279cc2cd843d4144c930964c104129406b5eee52352584ebcb34770aea54b17589b2
  • SSDEEP 192:y7ICTDvuSFXjrabHTUZWeEKWP2VkVaBO4ZjXvVXv0EVse4gsw7QPd5BkCU7EOJII:wIWcsfA+
  • TLSH
    T1BD25CD322A4D92F89C6C0791C80E53EDFF68152CC21E6D0EBEF6B5E49636A941C32D75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2