Extracted

• • Target
    Document.pdf.lnk
  • Size 2KB
  • SHA256 121eb0ea847a8c3c8b52d1f4e50c3841d0fcfa1818f5b79d949d0587421cdacc
  • MD5 88ca66d18b1313c680748be2cda6d36e
  • SHA1 7977cf26cc80ea55ce19fd8ff5cfc89a1f005e6c
  • SHA512 4bab4894ff3a762f78b3f002b0c89144f856fe7ecf90bfcf6e02b5235d0b3bee5838038ce6b1c6699d539ee273510d49557a644a58b6900f113c7aea0599b754
  • TLSH
    T133517E242ADD0628E3B3CF7298F576959EBBF863B5255D6D008587486C02B00EC29F3F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1