Extracted

• • Target
    ORDEN DE COMPRA 12111.js
  • Size 122KB
  • SHA256 ba94fd5b0ee3a19487a72eba21aceb384a9af3c117571c11d2d66f1aeed38e46
  • MD5 b707e98cb9c199c80dd806a85125bc3f
  • SHA1 9cb31f99744cd6af815ad8fbc468951c9e80a593
  • SHA512 7f620e0df9c2b2e551430d0a12c9bcd93b814952ff5505973cdefee5ac85bd76b8a7c2925a80df60d760cc0781f2fc364a2b90090cd1d5f38ad24294581cba5b
  • SSDEEP 3072:AVyfhuozjsM+KwzGByRjsd+KdwPB4dywzNTKBZH8UBju2+FwaQwIdsnwZBwKzKsW:VHd2wyC3DP5D
  • TLSH
    T119C3DE212AD9121DF07BAB60AAEBE5600E2FB6FBB1719259104D170D1F73960CCD37E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionspywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2