Extracted

• • Target
    info_New_Order_7132026 _PDF.shtml.JS.js
  • Size 3.0MB
  • SHA256 b8a3d16ad9e28103999357b592b517d14751308339f18845939f2766b7a6d488
  • MD5 ce9f9959ac0b7be8c9a218e306004fed
  • SHA1 17338a7fc75df105d717f12255063dc8282b4fdc
  • SHA512 88964716b6ab64163dba49bcab2f5309ebf2d3aa3c079f77aebdcf2f38f6a6c023c9e93386f8b7590a73b7baf3d73d3681eda38332bc27b7de1f5fbf7499d79c
  • SSDEEP 98304:ZB2z1RS3ZCWQWkTtuHrL8/tKIsfsmfRETwwrvdGcBg64FWqPqpSnFq:KPWiuj7fsQE7qP9A
  • TLSH
    T1B1E508120A47DC316A3E173CF53649D08D05980B02A6DF1F3D6AF1776BEDB1A52AE8E1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2