Extracted

• • Target
    shipment airway bill_pdf.exe
  • Size 222KB
  • SHA256 071b55748a4bf8024c8db0de1a1e0201eb18bac7def0ceb902f0ff18039dfb2e
  • MD5 cb8241dbfc0c15ca8618989f04b55bed
  • SHA1 bc23abe2afe3d59c58ef90fdf93037d1187aade2
  • SHA512 6bc9e10cf69234a8d03013574a0ca5157b9254039adb9af2df1ef0f090a733ac7f31c53cccc95227822f8bd02087958da18f0a88c9211903f0c1ef7d94dcf9c7
  • SSDEEP 6144:MEa0Nq+TfDPxVQGQfdJKeRVLJuBMCfjXMKs4oi:Xq+TfDPYGQVfLJCL0i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooksy01ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2