Extracted

• • Target
    RFQ PO-3401121950 .pdf.JS.js
  • Size 4.6MB
  • SHA256 a1a1a35f3566006ae558794b2219bbb95132f243b28aaca71b33ade3c791ebd1
  • MD5 6e2b45d4273512963fcab7e41f14e7e6
  • SHA1 b266041885c5df28640348852c57636958a37cdf
  • SHA512 b8e9f436c98a3160fcc29ad63214e1c7be787aa491b057e571b0d1fa33916657e8aba111a3223619692990ec87b5aa8f99f6dbd8e47735eb92a312aa428ea3c3
  • SSDEEP 98304:WczO9AQA80PwA4nOIGwNzcvkmO7v1/vny7rD+nWQtH51US9/D7n6uFDPW/tf6XUX:5LQH0oA4nOocvkr79ny7OWMqgr7n6uFM
  • TLSH
    T140265A8820D47751D8BC1E607E1DDFDF077E668B9B64E82B237435E52B89BC720A8319
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectioncredential_accessdiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2