Extracted

• • Target
    orden de compra.pdf.exe
  • Size 572KB
  • SHA256 0cac8ae6143ca74f0cd566c8ded5a586f03d9be060d2bab62513ccb4382196db
  • MD5 57d14055819d12a751c4a28cd55f65fd
  • SHA1 70f6ca046ccbf4ce95bb2df8e0776472cc226e75
  • SHA512 b431899bebf73953cc0983ac33d61cb22a1c5c15621c14d8de616941078587d9d16985e65bc42b61f5c0c2250eed956062515330ffa3c510bfd81d26183bf68b
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookd2g7ratspywarestealertrojansuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2