Extracted

• • Target
    Processed payment-pdf-.exe
  • Size 666KB
  • SHA256 1433291db27a99f71c5f0952140b96fb9110cffcf412b1bdcb0bdb1abb2cb07b
  • MD5 08d89644090b766629f1e9959d25be8a
  • SHA1 18c188ae809c9d9c9d54cdd0000fc3e8729be8fd
  • SHA512 5edc5175939c4ac0b17ece5e979155c9ceaaa5a2203516b9c7442058458ff6f5dd8be6d599cfa95e2e16ca1d03c0f1fb3da8488e1f57a97bb8a34615f72ff1a4
  • SSDEEP 12288:7C66Bm2iNNzPHWQqQqOsEmNg/Dy1jp4NYGttf4VsC66B:OVM1rzPHWQqQnqNgLfYWtWV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka09eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2