Extracted

• • Target

    CONTRACT PREVIEW-pdf.exe

  • Size

    677KB

  • MD5

    e8d7ef2ffa5024bcb5efdf102f4c2c4f

  • SHA1

    cdb42682a5290a61924eff92a99afebf449b4f6d

  • SHA256

    4b653e8332214d845b60536ad7f0ec8f669126e66ca7a183a95eaa8d9e6baf87

  • SHA512

    df66c72ec66f7a8bbddd9241828ff480cac403ddb5a856e33c712236008cae50a95259297e732a12b6e504b65f303915b6716c3983d10082ac0c153f0b3562aa

  • SSDEEP

    12288:ywFGHE39Wr76v13mik8ilzhFyylgimtdYM3O0V7bbF:y5HE3orGv1C8ilzhFplgZtub0V7t

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2