Extracted

• • Target
    Konspekt_literaturnogo_chtenia_na_temu_Otryvki_iz_romana_Evgeniy_Onegin__2_klass.exe
  • Size 1.6MB
  • SHA256 2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e
  • MD5 fc7ba2336d7a69b388a1b103f2db8eee
  • SHA1 260c49e336bf3aaaba4cd49c0223a200730d3817
  • SHA512 4fd2f24b99ab253579620a31565b231d3f5d2598381f5d988504468eed5d7ec560227509c571e8feb0b838e739777015b296ae045610f5767503302569f78670
  • SSDEEP 24576:DLILY8Xu/3y8UsG2BgYLicwnkyCHdebUKyZURQ1TgjTm:EYrC8UsGuTw3CHdeQKyZURQ1EjTm
  • TLSH
    T1D5755BE2F181C4B6E81301B18D3D9F20255ABE79576465DB628E772E4AB32C32477E0F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryfadokpersistenceworm

  • Family: Fadok, Fakedoc

    Fadok aka Fakedoc is a worm written in C++.

    wormfadok

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2