Extracted

Extracted

• • Target

    RFQ PBMS 401055-STR-22.pdf.exe

  • Size

    960KB

  • MD5

    d53349008874b77d087eac5ee7380c5b

  • SHA1

    676219bcf2de1c6b73a366cf880d0702cbfc6f99

  • SHA256

    e619a4c3b283514f6fec91b45659f766050d86117cbd75752096b719fb444b69

  • SHA512

    8fc2de3635c447216b1aad8f1dd0b41152f9debb1d53da877dfd439cfb8551e5ebebf2621c9cd2c243e87786645e2fe12cd02db256f0c70b750a6c330442adae

  • SSDEEP

    12288:KUTQO2iNCJ2uT8ejSo+aI2PfwnlOvAsijEo9Ogi5LGXshr9lyAKp:lD1FQtO5aIqAk8oUTixWsh5lWp

  Score

  10^/10

  formbooknwormmmtrdownloaderevasionratspywarestealertrojanworm

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Modifies visibility of file extensions in Explorer

    evasion

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2