Extracted

• • Target
    QUOTATION-PDF- SCAN COPY.exe
  • Size 402KB
  • SHA256 b0d65cf9bd6e65d3d8681b4366ceaa50cebea2895a960a2ea9972fe07a09d614
  • MD5 a6289ded7623666b11681d5a3d33539b
  • SHA1 25666ad2f60cd0a2852b59cccb0dd27447eddd9a
  • SHA512 a160798aaf3db9aa05d24d45a0a23bb45a9aee61c35b7c15139d36db6bbf0d247e1ce143adb87a7092a04db4e1b355596bf9b6dd8ae6d1b5126e4dfd40ec0402
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookm17yratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2