Extracted

• • Target
    Booking_Confrmation.js
  • Size 302KB
  • SHA256 fff8eeb3fd612a69fb1a76cb8d8e3c7f85b640c4d59f2e9e43d3376de1496c19
  • MD5 1eb8c282d9e15426e0f4c1f8affbcebd
  • SHA1 7953d6954f2c4f9338db7b25fc30212ba04d5a86
  • SHA512 2c2797745cdfef0f697a29450db0521f8680b7db0944dd1932bcb6641c5777bcdc46b2662f83673a2e15ca4e3eeeda90bcf4012395831b698a5301a58ffcb26f
  • SSDEEP 768:SdbUZ+g0SurLG2INzN4RulgIJ4M4BgmPQzNpDHzzNjilPfW5:gE+g0SurLG2INzN41JPQRlzNuP0
  • TLSH
    T1C06468B0995B8FE53E7822581C9E05EEFF610E9635E0C6D3703D712A2B301B7AE65D90
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionobj3ctivitypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Family: Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2