Extracted

• • Target
    Q5-Brochure.pdf.JS
  • Size 5.6MB
  • SHA256 3d8c2f1bf62cc3670f9ea270c0a7cfa830507e2fcc4d3de37ddc384553a7de08
  • MD5 5f5769ff7d050963ae7fe6fcad84c671
  • SHA1 112e5c389a1b6d5da0683883ce77b977598b0761
  • SHA512 4675fba0e0913bb7f593c92be1ddf824233cf9f88be39232926ed571a3177d71c1c84fb3c59ba595e073fcbf413946fe246bf8d2e6776ce2be496626426f7775
  • SSDEEP 98304:d2Xk6VAjErrAGOEqMHVNVIPSUkh4g/me7oEqZyaDV+vTJWR/MsQj:d206Vw8rAzEqMX/Uk+LLyaDV+bJwMs2
  • TLSH
    T16646A4136B57903A630A875E95B2F5E5E81A2C17B092DB07702CD824B3EBC5763AD1F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2