Extracted

Extracted

• • Target

    RFQ PBMS 401055-STR-22.pdf.exe

  • Size

    1.0MB

  • MD5

    bbbffc29c40c5e0e4aba9fd4e2a677f9

  • SHA1

    a9ab9ba1a90d144a6ba982003d2116a5b7dd42da

  • SHA256

    93e11bd9c359b03f6d2a3add3d1a109275eaadc5b9875b395f9d87e302db93dd

  • SHA512

    4381510e00a00b55e41e85cbfc4f67520570d43e1e76918679fba06812dcceebd8002e5f84b963a010c2f5f1c59f123f15b6ff6615ba174299166197845e228e

  • SSDEEP

    12288:FSmZqMm9II2iNPv9sXAwe7CrtPVGVh9dpcjSJnu5lzAKp:ZTI1LWAt7YVkdTJn2lDp

  Score

  10^/10

  formbooknwormmmtrdownloaderevasionratspywarestealertrojanworm

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Modifies visibility of file extensions in Explorer

    evasion

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2