Extracted

• • Target
    Price list,042026.pdf.com.exe
  • Size 1.2MB
  • SHA256 936f004ac961578281212bcbc8a2b86174cdfc9ef9ff5130a37339f08bc95fc5
  • MD5 5230cdf8a8c31f24b447dde5f6379382
  • SHA1 0057a5e704d79ebf69fb8c3039da50423c314d03
  • SHA512 6221a5fc534d2014760e613a3c016d7192f865c2874c4d435ea310eb6e9c55a0e37b7ccb08277335fc6f2140f9b1ef5f70e73564b23b271f093233c00ad3fd5c
  • SSDEEP 24576:hly1F9cwqPdJ3SnvJhvBlToPTsB4GpPv5yaFUn4NftcVwBg:G4wUD3AxhvriXGQDn4N1c+
  • TLSH
    T19A45AC04226DFACAE46517B7C96ED6B412A36D89E521D2037FE6BCDB3831F84285035F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondarkcloudspywarestealer

  • Family: DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2