Extracted

• • Target
    PURCHASE ORDER-PDF_SCAN-COPY.exe
  • Size 814KB
  • SHA256 2ee32fd5fafe174b2fdfa8dfd614686e9d8bf0552ff8ee78a3a1460566619769
  • MD5 c55553c3758598643d2082edbdf3e785
  • SHA1 7d257fd4752aa4a503ac11828e7fb2e81662e2b6
  • SHA512 ecb8e4ace3c418faf99591abc5ce2ab1f30fb842cc1624bd48f672dff4029b2137ec424aeac774f073bcf7b2970d7cd565a65d953b7612878ede7c4ad214dea5
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooko27jratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2