Extracted

• • Target
    Quotation-urgent-pdf-.exe
  • Size 658KB
  • SHA256 0efdd0e8aee22b54cf59895aa7ff5dcf84ccefed62dcdde3fd2ea83c56d28084
  • MD5 ed34a464ce97eaf1b397e53ba01c6a78
  • SHA1 d12ecc59ce707751a5e8e385d45f615b8c7b7be3
  • SHA512 461e145d18d0dd8b9bacdaccc72851cd631764f86f303ef9b92d66724ffba49cc4bf511591a142f847c8030fdcff5aa1aa41f71625e4cf887836abc7e5d0f3c0
  • SSDEEP 12288:46h7ERsSqUbZP02Zns9bnQtzOYX6P4jSCoQojDEpfsAIHnn:E+S5021MnumCoREpfsAkn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka20eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2