Extracted

• • Target
    swift_pdf.exe
  • Size 586KB
  • SHA256 67c174f4fdeb4a63472a22bb21de9d1b472da3521dcfa4ba8b285e25e1f1fa26
  • MD5 b3bbb1b11a711746f192643bf59c8e0c
  • SHA1 c0a8d057e624a36807e5853671c89e6844530533
  • SHA512 52a63b0211e143b36fa4c53b181f1d060ee391632ab1d55f50843482d175b7dc0b873c28de21441e096d6af787efb27f577009fe0f6fa3c26169314acb832f0d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2