Extracted

• • Target
    Çayırhan Enerji - TEKLİF FORMU PDF.JS.js
  • Size 4.4MB
  • SHA256 649f6c77cfa395e7f54b23e98c6d8dbefe82697f70296cd48e0100818a452335
  • MD5 3f893fde61279d71861d3c772907e8f4
  • SHA1 2c337bf7b38a97fefea6302d26a6dea59a9ef10d
  • SHA512 61ccc6d4688489519ffb4f660b37c0799755aecbf4f9322db942c9083d10c01ac2990d21cced2857460272a9aa7f8a5ae1da4a4a5f660642ef873c511b9f7566
  • SSDEEP 98304:vI1edQzuRbR8kAX4e96PbMosXJYzcJXZH540zWC4mEmvMZu8FPXF+qdSWb5gD1pD:6AIYWkQ4ewbMosXJYzcJXZH540zWlmEA
  • TLSH
    T1ED26C38A27A3973233329B5C93B1CDB1994B503335D5CB24717CEA2A769D94F630CAD2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2