Extracted

• • Target
    PO_PRD_0035963 PDF.JS.js
  • Size 3.7MB
  • SHA256 9541c2a21f0f1e5386309958e2060c3b5df15fd8da3f1d52dcce32f2a012e80b
  • MD5 c8c541bb9c8c4ec865432f1bac3b2aca
  • SHA1 9f1bf0a9f6d64058aac43fc157d1ffa8112b502d
  • SHA512 22d3a11d40d5750556286b9f8ddac5d30d7f418324a4114cb928dfda9b0a481bbd20af7bc7926721f8b7ac26e620bd5ff17dfc1daa9c38ce72dc7877b9752f75
  • SSDEEP 98304:SYK1D8c9Hf3/2CCGc9HwDp3QFAa85nC1KuJNy5+UfT/hd4Sx/o5pcU/IIETYOO1X:SYK1D8c9Hf3/2CXc9HKSAa85nCFy5+Us
  • TLSH
    T1590685AA17C051327F286F4DAB369920C40A2467A3D1DBB071DCFB54B77ED06634BAC6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2