Extracted

• • Target
    FedEx5050736636376.js
  • Size 296KB
  • SHA256 6d2ae73f2bfc722707576fda2165a72ca620c26599b3bc63bec5b4e97ebdbc3a
  • MD5 21edcec490f34933439ed3672d921aef
  • SHA1 376185d717517ac4ee814d0ef3ea8738016ce625
  • SHA512 1d6119ae8501b78a8ea67a2f172942c07191984a7ef392689439d4ce82e506d59352c059fe63868954cbfa6fc8f9445d4d48e3ef18481f092b6e33f87d43c14e
  • SSDEEP 1536:zspkAG8MMFk4fs4WtzD+FySuGP0IsgZNLn:z/AG88mZNLn
  • TLSH
    T16A54B55DB50063562D31A78FB9EE4158B6F00357160B212E7F6DE8DC2FB232A750BAC9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2