Extracted

• • Target
    invoices0000456_pdf.exe
  • Size 1.5MB
  • SHA256 a721e0a8a2daa0d5dee6ff75b846c1dbeb40f697221efb00866e450bea2b391c
  • MD5 a891012b787e51aeccb9783a34bdd04c
  • SHA1 c99007f4162fb4edf0bd3b45b9e23cc3bbc0e418
  • SHA512 3c11f7977dcf47aaa8e880201be68c00bf2d3cdd5982256e089063a55c6fb47bf0b1e7ce2b5050128751ab82e6a51840db3809c7ee30a70050b9c60dee30bf09
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2