Extracted

• • Target

    quotation#9006.pdf.bin

  • Size

    705KB

  • MD5

    6c0b2b41e40852c761db5ffbc2a140db

  • SHA1

    3b8deb400946a46e0c2343a7a3177f8285b81e36

  • SHA256

    f7ddeb2242efd10839b3cda4aecf4326490ebaf4e1ea292f90e8195fc5088e16

  • SHA512

    effd28fe340e5906d50da3a641485e9c2fa56477c556ab5c439b625b638ff6582c90351f3f44087c85b559def649a286df7ad9781c9df2d51e18800966311b4f

  • SSDEEP

    12288:VhTeH81jJUjvFXZGk54wfFeuITdvfU/r/vLt1afiqXqhqbDB8:i8MV8wfsT9sTJ1P3h

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2