Extracted

• • Target
    doc-22305447dubai proposal2026.JS.js
  • Size 3.6MB
  • SHA256 cf9161ef4c3a30e7f4f963deea1eebfa0babb1718b9038e8318f9c57a497cd6e
  • MD5 fe5dfd219a1a98be46810e66bb794ed8
  • SHA1 3a21a27d4f2cfc1eff19ba05fef31d9a15fd9721
  • SHA512 b094cd6c4ef6ec5890b3e20d2856af1289c5741c1302c20f2531f294aad116ce5bb0892d6b52de1f9f69341993c802dbe11a08c8751bc4f4ad7392ae7221ca97
  • SSDEEP 98304:NNHMj2fnEZ3Sn7VzdPAASBjNC6tKgtL6iqao44SLjyXeVbi0mVgC94GdjOvFQ4:N5siEZ8XUwVl94G5wQ4
  • TLSH
    T186063C6194307258696DCB3ED0275FF4096F700B1A3CBD7E36A9921899C2F8B198F4E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2