Extracted

• • Target

    Urgent quote request -pdf-.exe

  • Size

    812KB

  • MD5

    ce411b2f7dfd407c1a546e160193b55d

  • SHA1

    c061262cf1a7999d7ee59694dd0c8bb570987e02

  • SHA256

    8cfdcbcbb0b67c66ebb1c3a4cfb995424a9dc791c13d8df53cea06bcd8c2afef

  • SHA512

    af96c79b2af92840691a777a72e650c0763f0bc20ecd8d1970ac97cdd5048768fbe413dbd7d673f03f53bcace92d517eeb17b9a791c4c29fa4463b6a8c9c51ba

  • SSDEEP

    12288:h2D2DHPXsU51ZM0W52nCrgxRzrzbH3sgGJy3i9zxihIg95lvTHRyoY:Q2DPugfrzbHcFJwIohIgvpjRpY

  Score

  10^/10

  formbooka24eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2