Extracted

• • Target
    PI_4_5767189090436911808.js Pdf.exe
  • Size 1.0MB
  • SHA256 9bdc185c4c52ab97921a7d99b7bfe6e22ac5be828d999b19e41983b3c79af0c9
  • MD5 8bd2de9e1f41c0914129b5751eabfbc7
  • SHA1 7d44cda92b3fa3b237091ce58e0e6e7b416fef91
  • SHA512 2098eb4f8dbc6e19d1a8a7a9834af370f8d761fd3788afb6a96ba10cc6e5b2575a598e83833e0702a048667ac1a51a16611bb23e3d5b424d3a00ac6074c81ed8
  • SSDEEP 12288:+FfPpFLaKTy0qtEF2+ZFMISeJY564ALwCxcfWJAO0QDbesJmFPJIvFj3p/TSKyfi:2fPpF+Bt/+6v64/CJ0hF+Nj5rh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka19iratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2