Extracted

• • Target
    DHL SHIPMENTS NOTIFICATION 39952312 ARRIVAL NOTICE DATED 06012026_PDF.JS
  • Size 5.6MB
  • SHA256 478a38fdab62e21fd1ce46f170f19eb6e9b921e45ec307796a38695206a77bb2
  • MD5 4d893813c460952fe38805c3e09ecb49
  • SHA1 124bc08b4b78f5ecf3adbd95d843408f9269956f
  • SHA512 40c1ba611be0e9a06bdb6db53aabeb2db079c1b9326d2b4018be31bb739c79506196fb408935d7f121bddde753f159431caa9d34458f7d684fcb1d6767202403
  • SSDEEP 98304:7izhyQfR94nFKU9RMFDC/nnHaBD1nQVxpil893inrW/7bcNi7bsGt8ENTF:7+jjAFj9n3xpiYyr2wNS5fTF
  • TLSH
    T15946DA03A1655C268FDEC7EBFB1A65C56D0DEBF2340C9F2E102A4828D690D1A74D3EB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2