Overview

overview

10

Static

static

Quotation_pdf.exe

windows7-x64

10

Quotation_pdf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quotation_pdf.exe
  • Size 1.0MB
  • Sample221031-rf4vhsbbb9
  • SHA256 4678a529e9765c07270509abcbe33fc8bbe276d1d994f384018d1a567ef177fd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookwzicratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • wzic

Decoy

  • EF24Z5/12y4m4hI5

  • jLoHu8E+DnrM

  • yvj+8ztHCvfS2BuHVDg=

  • HXrRqNvfzbEriN/oHi8=

  • l+I+8fv4zC1Lwsflu7ke2K64cA==

  • P4z2vOX7mEaTTZ3LnhYy7GEuUP4=

  • Sm7yu+o0CidvaoQ=

  • 34Dms9fTqBNa+VsBEkQmO3Y9s71dfpeK

  • uq6SgrrKtBxGPjXeCH8UuWg=

  • 63I7jdIk/WyQgrMTMW1WWGA=

  • JV3VPdD3zS4m4hI5

  • PyUI6BwkBCdvaoQ=

  • OMwQJXOHZ1SmJaydwA==

  • S5LpruTt0MAm4hI5

  • qKzzNk5nQy6cJaydwA==

  • nAQ1yNNZyCdvaoQ=

  • +cw3bXyIVDeWWZqLdyi6zQ==

  • QecZjiC4YkOtWw==

  • akobDyI93xB9Rg==

  • FOM+cbML6Np47v5pKB4w92EuUP4=

Targets

    • Target
      Quotation_pdf.exe
    • Size 1.0MB
    • SHA256 4678a529e9765c07270509abcbe33fc8bbe276d1d994f384018d1a567ef177fd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookwzicratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks