Extracted

• • Target

    DOC-SCAN 20250422pdf.vbe

  • Size

    1.4MB

  • MD5

    e74e9c45b6174df5b9fce15b790ad64f

  • SHA1

    1b785dbbb0827ae8583269c3268e1fa4b66c4107

  • SHA256

    8ca7465b2cebc546b19374162071bd15dd523bf7c47822679af3f32bf7b19125

  • SHA512

    2ffcd4b22ba4a692557ea7f74c96d5eeb831818bdb18b071e70af1d6d4910c3478c2b2e1206253a174a860f4a5302cd002fac4dc52247ca97a8a3dbe978faa07

  • SSDEEP

    24576:802hUXc2IkQqu9ytsCv+ofYoXtztBzBYbZjD8Yhg+r4FzIjlHOkPEHF30+Wgb8:zh1YLki

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2