General
- Target Facture.NUM-71026463.zip
- Size 6KB
- Sample260910-psxkvsxsct
- SHA256 8ec26950dde5e11fd2727e4dddeac756c694a9dde7426ec0c66628fe0086fba4
- MD5 4d1f6e4f8ab06ad256f6ec1c4b35645f
- SHA1 ddd43e63d0cf9d19adcbf16fdd09b434c1960f47
- SHA512 ace02abc799f9d7290a5e997933220015e6336ab0727ae8bd752acb265de09fba004a27af6f177cebd33a78b75ee2e262407b2fd162964f7f8dcb1262a584be6
- SSDEEP 192:NPdvUElGFefItt4OeSCpJ4YsN6t5EoRdlrH1RSMDr:NPdEUItt7eSMyeEYfbvNr
- TLSH T17BD18F34D80B0DE97B69D2708EC8B30D7ED99C0ACF129A4FC0E8ED948D576B85652983
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Facture_Darty_285KJGHGV4_R84Z4LOP90J_K38522AZ89N12P9KIP507_PF_04.2018_N1.pdf.js
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Facture_Darty_285KJGHGV4_R84Z4LOP90J_K38522AZ89N12P9KIP507_PF_04.2018_N1.pdf.js
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target Facture_Darty_285KJGHGV4_R84Z4LOP90J_K38522AZ89N12P9KIP507_PF_04.2018_N1.pdf.js
- Size 44KB
- SHA256 cd4372a0931b45e985d98ab9cc7aea12d5f58ec6c5f3c4fc2394742c6b492adc
- MD5 41d139f89c0215e41760833595635c1f
- SHA1 440aa36ba025ac7ce68be9b1ebfea1391754a0f4
- SHA512 c5f02c7e56d905de82d7e716ae1122b9343875db4fdd082a8e96d82e18d0fc873b71773dfe646a1e93b250db3efa5a8d1036d92905e58ec07a0a52005d1e9a38
- SSDEEP 384:eXxNujgWJ13FXSxtJB+IlwQdWWubwcGDYe8WFZ/TWzWqUI78WyPyjAZ1ilYFvDLi:e0tvRpf6JE
- TLSH T10F233039DC78813F8973D69DCAC7865BE847C902232EE90A949723C7457B5C3A8D227D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.