Extracted

• • Target
    Sample order confirmation-pdf-.exe
  • Size 631KB
  • SHA256 c5d35a6e446100b36d3421ece29d936dc013fe088f05bcf86e947d1845403485
  • MD5 5891d47ec4dd1d0e6a47e59c0e655bac
  • SHA1 ea70458dabf76377c7265955ef96e00c5bb048b8
  • SHA512 6615a0b1e0259314178a9fb4e7efd9c283c2a7aa1c7520f3345fe3bc2da4eb262b0cb52b48579bbc4e1443f41687368fd6c3245e31cde0116fb2b4ebdad0f1f1
  • SSDEEP 12288:gwhuJv1oeQD6haFvTREGftYqF6JvNNpiP1AUuqSoVlUkQvhzps7:TuJv1oe26hiFr1uvNNpy1GqSoVlUbs7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka20eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2