Extracted

• • Target
    Price_catalogue_2026.pdf.vbs
  • Size 44KB
  • SHA256 c4f4dbc944a3b2a2e15682123cd10f27ca01d9cbf6016bdaedfc0eafb03a1965
  • MD5 f2bc8685486acdbe3237b4c6ab7b7ca1
  • SHA1 11f6d6c99591c3bfa4ffddc055ba0d52822f8b54
  • SHA512 54c833d001ac0e6a10ad6fc9c982613a71baa6a4d0c5271c9842128044221319b576915f6afe5382f58075428231da95d32edac6e222a2499251082927070eb6
  • SSDEEP 768:JVUmGCRAHmrbntnOs3E4DLDVKLxHT4gtLVZDU9Ae4VFf8mSz37zzHc74qf4:JVUm9aHMbtnOs3FDVG44/DUG1V6t37Pv
  • TLSH
    T13C136D74FE64322D9E8723A6DC485161CB38601945279460BFE9F34C640BAECF3BE91E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2