Extracted

• • Target
    Biochemservice Co Ltd-pdf.exe
  • Size 1.1MB
  • SHA256 0082123fa15fb43d060c2f764bdd9f31a19e53b185e5f6de37d1dfec2f59504f
  • MD5 0013ed29deca9b86928b96bb4c77b2c4
  • SHA1 2204f60387bb069b764141187a76555effa6f929
  • SHA512 2da67c529f96c8563bbcda880fcfd62c2d5566bc3b9d0b2daa164404b2134138875ee6a209aa4b1a381be0edf9d71dda7f6b705a769e6c3b98b935698ff6ad09
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooko0i7ratspywarestealertrojansuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2