Overview

overview

10

Static

static

PEDIDO 035 pdf.exe

windows7-x64

10

PEDIDO 035 pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    A9774D63581C0815D32C0C1724DAA6B671AAB6DD2E224E802FA372F4AEE73809

  • Size

    783KB

  • Sample

    221213-2pwwdabc6z

  • MD5

    4f006dddaf8c822ba8f108ca553bb533

  • SHA1

    49c13f043dbcf83547b2dab0b484c8f43fdd7f5e

  • SHA256

    a9774d63581c0815d32c0c1724daa6b671aab6dd2e224e802fa372f4aee73809

  • SHA512

    75ab056b14e73fbe1eb7b2748c3c1f75ea5b0fea9486a530d2e73bc3b613d47d530ccb5233c72f1d3316b0a7ddc0710ec6dfdc61c82731450bd353eb140503a1

  • SSDEEP

    12288:+y2rHwb5z6KOTgChH/MY0R7BzH6NVzq9hBzwfKEPYQ9eUspQAivUk/88QN8OBRN5:Hbd6AG+zHj9nzkPuUsmTvUk0P8A7

Score
10/10
formbookasdoratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

asdo

Decoy

31/RFVD/FFkpCuo=

LS2evkT1Hf54yJ3A01ZhjLFKSw==

Dw25w8eoM4HRQ9T8YA==

F2rI9TgH1uCf

VOuuxD/qTPifG/QDJ76coQ==

9smUEHwvvAcD3rnTM3IZg7fh

k4RlZq6jXYrfEg==

1+E7QsiGloB8qoio4Oh/

dALS/H0nMg+jCtM1RpZ+

thNv9GMouDLIFvESJ76coQ==

Tc54uifIU66mck2hvrtXnVbp

cINUAYgiqlkpCuo=

ma2AwPyPmpxd2bPRMksak0T7uEg9kA==

RlMlYJ9UpFIz7dg1RpZ+

klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=

V/nT2VgHD+hito+tBumEzTyVl5g=

0Zto8FjseN7v8MAW6ZkZg7fh

gbGlkddlXYrfEg==

pymXGHouvjhnKg8+qD8bLcY=

VelU01Tk/+CzegtywL4=

Targets

    • Target

      PEDIDO 035 pdf.exe

    • Size

      947KB

    • MD5

      8af2df525a8683404955d23109e7cc9d

    • SHA1

      a823a9411db0121dd94ebdafa39ebca8d4dce5ea

    • SHA256

      082215d9272c7f706e6cc3b5f75abaa5e264566c1f6dec9fd0cd770d4bd86b4b

    • SHA512

      b87743cee0c81a8d83f2c2cabea1e93a39b1ae75c68868c5161266be0b8c03777551fb7043382e7b05af632fd126455889ce4841f89b44559ecfc5d51cf96a0a

    • SSDEEP

      24576:Y94yl9weJIiPpgwQDbRgOEsiwwdBhZmBHMe:5y3wYhgwQrEDjdBhSHH

    Score
    10/10
    formbookasdoratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks