Extracted

• • Target
    Archpre_086544.pdf.js
  • Size 956KB
  • SHA256 81e61bd60b0742417d9b29aadad3a2c13bcaac8efb82454a5a39998be6acc99d
  • MD5 e7d04f6616d1432ee5e59738277b1ef6
  • SHA1 f2d396075e4da494f335173ca7b0aa4aaf8028eb
  • SHA512 868cfb806f199c20d8b9ed042cf47fb79f0fef4e99c7dc43834e2de2f2200f371f88a0a46958ae0eff3864ed01d0840e2fdbe68b10a6567e316e93703c93b810
  • SSDEEP 24576:jD8xD8AD8ADD8uD8qD8ID8+D8GD8T7D8hD8XqD89D8UDC8D8UD84D8gD85ODkD88:jDEDLDZDDXDJD9D9DPDI7DsD+qD0DfDY
  • TLSH
    T1C0253A70ED2407AA4F471B9EFCA50B9289BD8519822650F5F6DE074E60074FCE3FE269
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2