Extracted

• • Target
    Payee advice pdf 6.29.2026.JS
  • Size 4.7MB
  • SHA256 7881aa8363eeaa52111abeb6a1178efad0e948626e00b2b825d0f128aeb047fa
  • MD5 a8cd942e54b62570476cfef7e7904000
  • SHA1 bdc655fe32e9ceb8a4fb5aaf27b90cfd15584a9b
  • SHA512 8d283db53127de6f5ef31fa85d18c3b8f6dd67f6ae338926830f10669f5cc5bfac11036ff80efd5c15bf2ea8a3898dcacf417721e8cba7aa424bd39b8036aa8e
  • SSDEEP 98304:lVPJXlFT4n+6+eCBVCCJdLs+FR0SPPAUsHt7RzidtcDk1WRbvooioVPJXlFT4n+y:K3UhR0SPrsHt7qtcDk9N3UI
  • TLSH
    T1A3367D484524B786D0FC9B248D0E7FEC1A4ED447FE69ED473A2A8A758B08FC27644793
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2