Extracted

• • Target
    435543455434554_pdf.exe
  • Size 296KB
  • SHA256 c3eee37f03d307023521890718302eb2f9ba7d4ec465a1f10c7e9d408ceddc3b
  • MD5 3c0c0ba52da81b9087b5e053f7ffb68b
  • SHA1 652bfed4cef60a257812883130a9ecaeb52f7c4b
  • SHA512 de8e4483013d2349bcf465f7aea138901c688acfd69992768f4daf036e4c102ad199deed4313b1fc2b746315d4495ddcc837f71e45321ad71444eb336202b43c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2