Extracted

• • Target
    PO 2026_31_8.pdf document.JS.js
  • Size 3.7MB
  • SHA256 75eede3d1894ba754a4ea0121ee69d9dd9920d59207a5994fac42ba52e79e514
  • MD5 d14af05cfbcbf71a1e3865dd899e46e2
  • SHA1 b935ee817390841df6765e1b9b709c0f7b5154a3
  • SHA512 bfc56fe00a9e84a8254f55cc18b76a37d5014c8c5337318085662e3ede66f9b4522ae8881328c5e6407190c09df3fd0ac5dfb188cb721ddabbf5b1dc11e2fe5e
  • SSDEEP 98304:G5G3Oyuv7uKE77zYwjrvoT2iFQBI9pY7mIuZufTC8pG7dnDgIYv+e47u:G5GeLTuKE77cM0Y7mvuGxn7u
  • TLSH
    T168066EC40986FF83E4FC19344E1D0AD1C72B5583A612EB0337B875679B5FE90236AEA5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2