Extracted

• • Target
    ORDER#269230_40976.PDF.vbs
  • Size 1.1MB
  • SHA256 8ac59902bb83131809df06cbc5ebd4899c6b6ce98ddb9f6171b1622d21e1f7a3
  • MD5 ae7fa8bc27f0d3f7375bf3aa966d1753
  • SHA1 e8c4e647153759d1968a2ba0c63d71f36031fd9c
  • SHA512 9635e012606647c398aff4eebdde807d416c5050a5c3b4ad4ff37969075d8e65a03b31c61de108b825679e654122b36e9076c52d8df386a4b7b6240437c52f20
  • SSDEEP 6144:rwm/Ro8GYkfZP2KdQrbZzN7QhtvnJlhVZ77iYfMuRJqG5gdhmKR14IXN69jPp:PBN69l
  • TLSH
    T16735518FEDB8207D4EC593845974D72C71E0A840B658A433E4E1146A2FEBFB17E8E9D4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionwshratpersistenceprivilege_escalationtrojan

  • Family: WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2