Extracted

• • Target
    FedEx AWB-Documents PDF.js
  • Size 2.8MB
  • SHA256 b5bcfe5af4011274e4885aff886350a9c6fc39be4c17cb0b33ce7d813cd7bc5d
  • MD5 f739d4ed3a949988844220f1bc299ad7
  • SHA1 ca4d853de9e0493e39452b814bff48cd9e33766e
  • SHA512 2f5aeae23fa13d7def739924d94c21ca1359ceee35922afad13b71ffca44998545a84e0ea06aaf688957832cb570b4f15f66e38501d4ac7cb999d22333e170b5
  • SSDEEP 49152:7p1jMcM14n4cHP2rWM2fcPovAJy5wB0Wlncwsi/nsvykmtH0eDgBGEQINlBRs5cQ:7p1jMcM14n4cv2rWM2fcPoYJy5C0anc6
  • TLSH
    T142D5922FCA3C2F6D35AD1BCEDF51F5D8C68FA683C054C9CB7552921992368D69AC02B0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderxwormloaderpersistencerattrojanransomware

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence
  behavioral1behavioral2