Extracted

• • Target
    IRQ2107797_pdf.exe
  • Size 397KB
  • SHA256 ddfdab103d34dfc6ddd6518745c101342e9953e6c2e049576e15ea570fb16e3a
  • MD5 9c4eafada8143a2b4cdf8c37650421a3
  • SHA1 9f9b7f895fba201cbd7f7c784c9c840ceab5a491
  • SHA512 0b60c1eb979865aa2c50bb2051ba3199065807091ce9e2069b42b5080004885d9f2eecc64c6e84860d88077834ecad84b7b3d582066fde3fe4aa5ff10b912242
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks09mratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2