Extracted

• • Target
    Purchase_ListPdf.exe
  • Size 845KB
  • SHA256 c99293149ab054a2abc7c82e156caa0d4d8c36583ec634fd1e88e24c4892a02a
  • MD5 2e1b1d7dbe2bbb0fa0fef5aa1ee2bce6
  • SHA1 cf98a4322cff27d7f7b5ae765b5e02d10a53534e
  • SHA512 c1d86f2fcc766f3ff61c47f40a2da6630fcf03961a8c756de1cfdcf147b1361a70351bb91241c78c24b285efb41ec41eeee10dbc27fdcfb0baa2cdfd0b11c4d1
  • SSDEEP 12288:dI7WlsMX5xhGLn7bv/HnZOSpJ9fYMtaDNUUJ6qPQqUq0WiCvV3rPCLhJmUTdHdHx:y7QjG3bAgh9wD3PQqUqNV3r67
  • TLSH
    T105057C6C3630B89EC4DF89358950ADF7A6102C6A5307D20393973D9BB93D796BEC41E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionxwormpersistenceprivilege_escalationratspywarestealertrojanexecution

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2