Extracted

• • Target

    Foreign Payment swift_pdf.js

  • Size

    342KB

  • MD5

    4e474a544aa97316f1f1ddf56e9c5c70

  • SHA1

    b9775c6cf7a5c6c74b8d9ed1776d35a5a1d8f494

  • SHA256

    46af67f4a2a2c3d7bc6d8743941718c5abd1f3cacb0dd08f9a4c24651a843752

  • SHA512

    4ba58f40318d2582c43e84acb993bb8e9684a3b3955e771043e0742e309020e5482b6aeb5d437dea6c4ecd31ffcf9d6df8693b268c5ac187ba866c4f04d2fbaa

  • SSDEEP

    6144:q8OjK5gRBwhZ2FlbDsmxSvODgTEqEqSMa7Z3tFuQilEI64OHdlG:buKJUlHLxSWDyREqSMstFclEz37G

  Score

  10^/10

  formbookvjw0rmxrobratspywarestealertrojanworm

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2