Extracted

• • Target
    IRQ2107799_pdf.exe
  • Size 434KB
  • SHA256 c657108efc3f78a3052d15e5f2e8593181566f45c2c3e3316437bf7d6632095c
  • MD5 f6666d2dc66bf27af205c487c6a017d5
  • SHA1 639246ec825c9353bb22842de1b9411e53be2f35
  • SHA512 72bef879fb5e924078f7af3808f026ce587af4d0abdb60a84696eeb147c79a4b4d6cdfbb16286657a80ae42f9ffdac78f0d61aa869cfa2c9809795504085af4c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks1m4ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2