Extracted

• • Target
    SHIPPING INVOICE DOCUMENTS.pdf.exe
  • Size 556KB
  • SHA256 79cb41c5d286b5e8062a31de81a893f221a8ea7bc887a74030b3802dbf5bc619
  • MD5 9fc8a2ba5be6233cd051a5cc29a5dec0
  • SHA1 e65c471126339e5415518d896197bc17c6830a95
  • SHA512 1c01768316491a477a772e35bc3f847ec5c2c468357e693e3e3d4b1bfac0d9ec0bda173a32f081a8355334952b90c88deba50ee357e9167942c7ca832c0f0423
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookfi46ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2