Extracted

• • Target
    8f4cb07a4333f15fa8e585b00ef08ab329fda9fbc3802fdbdf579c194096ba9d_offset-manipulation.js
  • Size 1.2MB
  • SHA256 c22d877c9cdf9038f2f78b1935ab6671b6a66a5a6c397a1adfe91d63d9e14c65
  • MD5 531e85211daded7e37f6c828c88cc772
  • SHA1 2f53b4fa020f1110ae421b9eef88d6a948550acf
  • SHA512 884f7598ec560e6b3ecb0ba0eba6bf3706a207a0dea1a77c329377ca50ad9e88c17405b575babf995338fc237cf5d7742566f63b2f6051ef516440a7932f0af2
  • SSDEEP 12288:CzaaPdSTjA5yXetplEqUuWBnmcjWEDL0w3Hf/5tKZVjOPSe2ZVJiCJU:WawSTjpfXr3DLFKZZwSe27wP
  • TLSH
    T1784518FFC8DC616B35E3EF12A27ABABC463525D6AD22551E208137B32E0C146F702657
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostexecutiondonutloaderremcosloaderrat

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2