Extracted

• • Target
    HSBC Payment Advice_pdf.exe
  • Size 298KB
  • SHA256 2eeea519e17a33aeece43a9157b2e2caede5b6b34a9afa424d324030cbac48aa
  • MD5 5c65f102aeb8b30e62964f58423b2378
  • SHA1 1c9d548c8d746f0338456f8ed79e7ceb5561c2d8
  • SHA512 664778d450b612477546cd01fc60e3531296964ec390918299b61a6447620c3fc97da5e8b608bd8747e921a4fb721c80ffcbb84f2ef9df5e5c01dd68c260dadd
  • SSDEEP 6144:fEa0YGA7vZ+IlQ4qc6qAeER1ImpALwIdG9IM1gdCIV5R:pNv3ScmeyImpFIuvgc0R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookfigcratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2