Extracted

Extracted

• • Target

    MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe

  • Size

    23KB

  • MD5

    8531ba62c67d13ce3ad94bcd42bb2c00

  • SHA1

    a9cee94ac6fe7afd2f2647e08330ce47269c57d6

  • SHA256

    465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c

  • SHA512

    a183e13a1c4231a702b7c560b69313684d08ffb46580cd3fbc3641e197560ee61d27ccd109ba457ceac33b62f1fed15a34d6fe0a67f3989b7bfe19f4e39f5c53

  • SSDEEP

    96:mHoxS1E/nqEnkpB0gJ2YGkLtUzVHEHtA6xQkVbR9x5YSGOomjfjw5aBZ7bBlHWFU:y1E/jSOVYrLtF/6ObR9xFyajGaBZzHz

  Score

  10^/10

  purecrypterdownloaderloaderagentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2