Extracted

• • Target
    Comprobante de pago.js
  • Size 1009KB
  • SHA256 1f2223afa04f4df83e130651462fdd0ebbd679a09123d2233712315f4db1b547
  • MD5 1fda17c33b20c0c44e4bf698888bb012
  • SHA1 354fb326620bc67caa341ba908b7e9dcdad9484b
  • SHA512 02b122cffb33a1cd2ef44127a4ee84b4b4aa2b608f94b7e6f3f7c1495210bc92d51f79d53c3c77575ef655317e55336c03948c0f221249aec602055c3a2071e1
  • SSDEEP 768:hDbPvDLlrjhX5HdbHpJNxz/bv9xFb/b5dPf973zJhnVFlZJNjNJj/z/dN1/NbZjD:xJz
  • TLSH
    T17C2592ACCF6CA4B5EE4360EDB8E64630FFA4955E52925B94361D40E423E9F410F93B38
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2