Extracted

• • Target

    Urgent quote request -pdf-.js

  • Size

    341KB

  • MD5

    59b4d0fb62bea58db86b5f9b82382f21

  • SHA1

    57bae158e509b8e23c3347efeaf00553920b8bf6

  • SHA256

    3580ae39b6b33aa67838c5c1ca91b6aebf91e470360fb13072497e85df748871

  • SHA512

    d09975b8ecf9de689bf7e9cebfa9430940b6f465e00a15b4baeb839c598c61cac380263db96f027ef4328b705a773c3a4543961ba1806cc31c86a2fd82f29e6e

  • SSDEEP

    6144:D9w3fOYrR6SInG2u3Wp4cwRDyTlMiAaJ/jpPiWUiSFtroVSSM1tZQfm:YWaR6SInGj3WN6DyhMiASjpPhSFtroVI

  Score

  10^/10

  formbookvjw0rma24eratspywarestealertrojanworm

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2