Extracted

• • Target
    Comprobante de pago.js
  • Size 1.5MB
  • SHA256 f0c5bad7fa82b32db818a313d83a025e97caa2d7ffd821e77524668881cb0e3e
  • MD5 f7299d0658afe3b7a97b84bc7b65a496
  • SHA1 f913ea7f090a694a782d595989f0b876a1d3016a
  • SHA512 e2644647c3ee22c80e86c78dbfe8aafd28210a99498922fea38378a79bf11c153d85c39ea313b27cdae0ac7110d3d3d289d6afea9318d71c27ff7bacf8d3eef2
  • SSDEEP 3072:3cbKcYjYNvbYOVabi/iIafn/ig7l5acHwvF6rDjkwQJoDb1TCHRCVzNtjdXQaG7o:Ebh9PKocZHZb7/vppZ
  • TLSH
    T17C755A3E1D1A923B9AF5DA08C2C20427F163955B75359F0840EF238DABE3143B5E676E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral1behavioral2