Extracted

• • Target
    REF344266679_pdf.exe
  • Size 226KB
  • SHA256 129f2604f1e1718d464a01fcd1c76e845e784d783fed333642b77e231f121ef3
  • MD5 b94e95ba33a76a3f5fd8e123d9d8f4b7
  • SHA1 63393ef816336b47af8d9490100cf335c8d60997
  • SHA512 fe542447701bc3037a2613d483062ed87a5299112fda9f6ec560c3a7b78e19581e2be14a521f4cad1d3fd40246d019124e4c7839c54775a55e5a066d18839805
  • SSDEEP 6144:qweEpFbv7aGAwgdX7Dk4z0HZ13Kdx/lMeydbH:bFb1PiX3nz0HvseD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookaxe3ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2