Extracted

• • Target
    PURCHASE ORDER 11052020_pdf.exe
  • Size 357KB
  • SHA256 bbb3afd846cc51e61380effeaceabc21e15c8b4ccdab6d821697191605a00c60
  • MD5 466ed09e4da8ddca014d22b654290167
  • SHA1 b4e123d4d2f00c79bbf4a73fdb8488de971c7876
  • SHA512 ef4af56909dc36860e7969be0d63e3bfe48385590ae3b1df03c976e66d12d785ed13d99ea98a5012b1c5e4ae88b802edd7bbcfe1e6c54afeed1d76452e402b67
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2