Extracted

• • Target
    doc00643620260826121316-1.pdf.JS.js
  • Size 4.3MB
  • SHA256 7162921e306ca817721de7a869ef093eec11840a553d4145b823f8ab7e6d6592
  • MD5 84056331c3f7b7088ddf99bd37fc18c5
  • SHA1 093e1adde05153b6c2e4e5ed27ba825f5c07c471
  • SHA512 3c254f4fb3f24176a25ccad6c82b7072f5c0b23b1a3a29a922f87317ff8bcb520bf0b8357c05d0f96e38379fd489703f22469f944b1d4ca290fdfd59c19455e2
  • SSDEEP 98304:FclF8UIuJNZ9LT60YuEUVyidaGZcWx6wHAwMRe0EheZNLanIQ:mUcBT6bluyiVO06n40Ehe1Q
  • TLSH
    T16E2674980765D4BBE328127C9A268720A5CD53438DC5DA3D3CFDE013EFA694E3268D9D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2