Extracted

• • Target

    Ödeme Tavsiye Notu - 0000274553.PDF.exe

  • Size

    535KB

  • MD5

    40f56e889ab81bdb74a78010b3fe006b

  • SHA1

    03fb1836e3ea68ed18a41b10ce530d09f3ff3308

  • SHA256

    4c143b9e9804d87732fa2ca95ddc355cb0b5944ad57f33b6fe08fac0947d32f5

  • SHA512

    f3b0bfd497390cfaf0e3eadc6f54f3ad804812d2cdd46654916f580bddb4be10e50d42535c96a1aa14256884490045317e5756662d460fbb592077b6d4af9894

  • SSDEEP

    12288:slzAKpkuaBv1XP2uqLerOEU0iFr2FDaJ3:slDpQ/WXEU0iUDG

  Score

  10^/10

  formbookm9aepersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2