Separ is known as a password stealer virus, with its first version detected two years ago in 2017. Latest variant uses genuine 3rd party executables (non-malware) in order to support its function. Separs main module pretends to be a PDF file, but instead of opening in a PDF reader app, when it runs, it hijacks the computer by executing legitimate apps that can enable hiding of the nefarious goal of stealing user credentials. The malware takes advantage of wscript, it is the built-in scripting engine for Visual Basic scripting language.”]
Source: https://hackercombat.com/whats-new-with-separ-malware-family/