File name:

1747066492-105138-7608-805-1.eml

Full analysis: https://app.any.run/tasks/1596f99a-686b-458b-8226-862fd026a03d
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 13, 2025, 15:11:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
attachments
attc-unc
susp-attachments
httpdebugger
tool
stealer
evasion
agenttesla
ftp
exfiltration
phishing
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

7FD1F4ABDD78EB3B00761B264A291F52

SHA1:

71EC9AA709ACE87CCE410E8D7E28DC0DB56BCAEB

SHA256:

A73030D54892AD422E9F3EB4F4CDF946A51218F784060DD9B4F7F9E51E6507BD

SSDEEP:

3072:mKk9ft2q/dspztLw99HkyuY3pC3FLIXv2kGqV3iTDE0+DUDUC6BbT87eGNC5:9Y40EetBH5C3FLI+tqV3KpddwVGNQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • InstallUtil.exe (PID: 7412)

    • AGENTTESLA has been detected (SURICATA)

      • InstallUtil.exe (PID: 7412)
      • InstallUtil.exe (PID: 6228)
      • InstallUtil.exe (PID: 1280)

    • PHISHING has been detected (SURICATA)

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 6940)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 5048)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 7412)

  • SUSPICIOUS

    • Email with suspicious attachment

      • OUTLOOK.EXE (PID: 4200)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6872)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • InstallUtil.exe (PID: 7412)
      • InstallUtil.exe (PID: 6228)
      • InstallUtil.exe (PID: 1280)

    • Connects to unusual port

      • InstallUtil.exe (PID: 6228)
      • InstallUtil.exe (PID: 7412)
      • InstallUtil.exe (PID: 1280)

    • Connects to FTP

      • InstallUtil.exe (PID: 7412)
      • InstallUtil.exe (PID: 6228)
      • InstallUtil.exe (PID: 1280)

  • INFO

    • Email with attachments

      • OUTLOOK.EXE (PID: 4200)

    • Checks supported languages

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)
      • InstallUtil.exe (PID: 7412)

    • Reads the software policy settings

      • slui.exe (PID: 2096)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)
      • slui.exe (PID: 1056)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)

    • Disables trace logs

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)
      • InstallUtil.exe (PID: 7412)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)

    • Reads the computer name

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)
      • InstallUtil.exe (PID: 7412)

    • Reads the machine GUID from the registry

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)
      • InstallUtil.exe (PID: 7412)

    • HTTPDEBUGGER has been detected

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)

    • Checks proxy server information

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4976)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 1388)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 4188)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 7392)
      • slui.exe (PID: 1056)
      • InstallUtil.exe (PID: 7412)

    • Manual execution by a user

      • Comprobante de pago N6789500643233352.pdf.exe (PID: 5048)
      • Comprobante de pago N6789500643233352.pdf.exe (PID: 6940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 3) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
24
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe ai.exe no specs winrar.exe no specs winrar.exe no specs slui.exe comprobante de pago n6789500643233352.pdf.exe comprobante de pago n6789500643233352.pdf.exe comprobante de pago n6789500643233352.pdf.exe #AGENTTESLA installutil.exe comprobante de pago n6789500643233352.pdf.exe installutil.exe no specs installutil.exe no specs svchost.exe #AGENTTESLA installutil.exe rundll32.exe no specs #PHISHING comprobante de pago n6789500643233352.pdf.exe #PHISHING comprobante de pago n6789500643233352.pdf.exe installutil.exe no specs installutil.exe no specs #AGENTTESLA installutil.exe installutil.exe no specs installutil.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
1056C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1280"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Comprobante de pago N6789500643233352.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
1388"C:\Users\admin\AppData\Local\Temp\Rar$EXa6872.632\Comprobante de pago N6789500643233352.pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6872.632\Comprobante de pago N6789500643233352.pdf.exe
WinRAR.exe
User:
admin
Company:
4FEJGG8>G:F??<>9E
Integrity Level:
MEDIUM
Description:
<=4?AG?3E87A>I<E9;?=AA3B
Exit code:
0
Version:
2.3.5.6
2064"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—Comprobante de pago N6789500643233352.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
2096"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
3024"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—Comprobante de pago N6789500643233352.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
4188"C:\Users\admin\AppData\Local\Temp\Rar$EXa6872.1840\Comprobante de pago N6789500643233352.pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6872.1840\Comprobante de pago N6789500643233352.pdf.exe
WinRAR.exe
User:
admin
Company:
4FEJGG8>G:F??<>9E
Integrity Level:
MEDIUM
Description:
<=4?AG?3E87A>I<E9;?=AA3B
Exit code:
0
Version:
2.3.5.6
4200"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml C:\Users\admin\AppData\Local\Temp\1747066492-105138-7608-805-1.emlC:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
10
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
4200OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\App1747149102495090000_F6F05BCC-21DF-4917-A472-EAC31E86D886.log —
MD5:—
SHA256:—
4200OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
6872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6872.48273\Comprobante de pago N6789500643233352.pdf.exe —
MD5:—
SHA256:—
6872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6872.632\Comprobante de pago N6789500643233352.pdf.exe —
MD5:—
SHA256:—
6872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6872.1840\Comprobante de pago N6789500643233352.pdf.exe —
MD5:—
SHA256:—
6872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6872.2364\Comprobante de pago N6789500643233352.pdf.exe —
MD5:—
SHA256:—
6872WinRAR.exeC:\Users\admin\Desktop\Comprobante de pago N6789500643233352.pdf.exe —
MD5:—
SHA256:—
4200OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkE0AD.tmpbinary
MD5:80C3B2ECBF021EAE5A2CE6AFCAF098CD
SHA256:3F7FBA8D5069679B921C5702C740358E0CF49E2DBDD679685639ED20892F31BA
4200OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:3D01CBB9EA37C5E467B0A7ED0F82CB93
SHA256:8053633885E3D63FAED06A30F27CD5F1BDCAFB31C025C7B19B5EA6B7D62AA167
4200OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:4C9D109F2668E0D783F3BE5B25A8D4BC
SHA256:6804807E08AC783542FA4C1A92929F1F6D1E95133E2E09B5C4FB361DE7FBB41E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
54
DNS requests
31
Threats
33

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4200
OUTLOOK.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
8148
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8148
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4200
OUTLOOK.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7412
InstallUtil.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.193
  • 23.48.23.173
  • 23.48.23.162
  • 23.48.23.158
  • 23.48.23.143
  • 23.48.23.167
  • 23.48.23.177
  • 23.48.23.150
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.66
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
roaming.officeapps.live.com
  • 52.109.89.19
whitelisted

Threats

PID
Process
Class
Message
4976
Comprobante de pago N6789500643233352.pdf.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
1388
Comprobante de pago N6789500643233352.pdf.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
4188
Comprobante de pago N6789500643233352.pdf.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7392
Comprobante de pago N6789500643233352.pdf.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7412
InstallUtil.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7412
InstallUtil.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7412
InstallUtil.exe
A Network Trojan was detected
ET MALWARE AgentTesla Exfil via FTP
7412
InstallUtil.exe
Misc activity
INFO [ANY.RUN] FTP protocol command for uploading a file
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1747066492-105138-7608-805-1.eml