Extracted

• • Target
    Booking DetailsJS.js
  • Size 1.1MB
  • SHA256 f3acda5aaf5d5a1e5800f7aad5027c85dd736416242e2b8865737a9f96c4f349
  • MD5 614919b0430ff80730be0211e14aec5a
  • SHA1 3313c3dec83a17f82072f56e5f7e825c8b04e130
  • SHA512 95770a77e6705f36f0f41a84944d067e25875605100486326753b0cf025f733ae57675ef7791880c77109e6a39c467a1a4ec1d7b5cd9e4c60a0e5d344c58583a
  • SSDEEP 1536:32dM/xT5SkadO8lNjZ4mtcXSuu0IaaHx9ZA:n
  • TLSH
    T18B4596833E538388752D5868AA51727CEBBB75207AE06D1438C5EECCED245A8CF74E74
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionobj3ctivitypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Family: Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2