Overview

overview

10

Static

static

PEDIDO pdf.exe

windows7-x64

10

PEDIDO pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PEDIDO pdf.exe

  • Size

    752KB

  • Sample

    221220-r9cm5aab62

  • MD5

    e3698fc9d5c6152297de00168360d550

  • SHA1

    eb53bcf6fd90162cc5b3d74fd018e6a981919c43

  • SHA256

    26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125

  • SHA512

    7c3c6c80fbda902fbde5ff554147852295d7c9508f4237ca3fba8ce03e7ae94cabb8d259f01dcd029036c5b7e845ac6c657a7638b5e9319ff66f6f298d9e55f2

  • SSDEEP

    12288:mUdLctyTcf0hA/p4f2MjHJJY90LmRO1oTznmbhMGg3g43XR8:0UT40a/p4f2QLmEiTznmbvg3R3XR8

Score
10/10
formbookasdoratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

asdo

Decoy

31/RFVD/FFkpCuo=

LS2evkT1Hf54yJ3A01ZhjLFKSw==

Dw25w8eoM4HRQ9T8YA==

F2rI9TgH1uCf

VOuuxD/qTPifG/QDJ76coQ==

9smUEHwvvAcD3rnTM3IZg7fh

k4RlZq6jXYrfEg==

1+E7QsiGloB8qoio4Oh/

dALS/H0nMg+jCtM1RpZ+

thNv9GMouDLIFvESJ76coQ==

Tc54uifIU66mck2hvrtXnVbp

cINUAYgiqlkpCuo=

ma2AwPyPmpxd2bPRMksak0T7uEg9kA==

RlMlYJ9UpFIz7dg1RpZ+

klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=

V/nT2VgHD+hito+tBumEzTyVl5g=

0Zto8FjseN7v8MAW6ZkZg7fh

gbGlkddlXYrfEg==

pymXGHouvjhnKg8+qD8bLcY=

VelU01Tk/+CzegtywL4=

Targets

    • Target

      PEDIDO pdf.exe

    • Size

      752KB

    • MD5

      e3698fc9d5c6152297de00168360d550

    • SHA1

      eb53bcf6fd90162cc5b3d74fd018e6a981919c43

    • SHA256

      26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125

    • SHA512

      7c3c6c80fbda902fbde5ff554147852295d7c9508f4237ca3fba8ce03e7ae94cabb8d259f01dcd029036c5b7e845ac6c657a7638b5e9319ff66f6f298d9e55f2

    • SSDEEP

      12288:mUdLctyTcf0hA/p4f2MjHJJY90LmRO1oTznmbhMGg3g43XR8:0UT40a/p4f2QLmEiTznmbvg3R3XR8

    Score
    10/10
    formbookasdoratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks