Extracted

• • Target
    af77bb57c12e40a0f4ac6831bb8e6951d0c583fecea0f0132341ac676933e2e1_offset-manipulation.js
  • Size 756KB
  • SHA256 9b53104d759726e1dc3af556eaf4ccb3bf6ca64cdf92a207f0e926ea3f6f8709
  • MD5 3e40448d1a2de0eae6e7786206120efa
  • SHA1 828e2cceede8a073cbd105a64fef2f84de434866
  • SHA512 2b306701de24c3357dc470df4102e242ea09986b53089badbdd3db09a6b24cdee6e2a42a77ba51526fd1e54411ab50f718e057fde5571f856e2d0aa368178b87
  • SSDEEP 192:JnpPF5lIu+Q++Qu7r5CZrWCHFdoZuu2CzrVrCnHAz8Zp+9sgnAzfx+TCjXDE9GKE:JlNIuXDArWUoLwjme3
  • TLSH
    T135F412144ECA59DF40AF564E327A2725CE39E10534729C1E321B9BDB6FE0F9B8502CB6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2