Extracted

• • Target
    E-DEKONT_pdf.exe
  • Size 344KB
  • SHA256 28384833cb4f57932b5344a38245cc995941d7fcccc387a2ffa7f295c91108ac
  • MD5 fe8637b7f28206897219305735fdc407
  • SHA1 9aaa5209476907a311d9905ab0566aadd833be3b
  • SHA512 9539220c2bc089d627e0cbfb58233f538b0582cde4d9bce958693e97346b5904cbe84e2c75f8374d1b5de22a932bf69dd3976d529b58badb7bbf3ab3db4cd21f
  • SSDEEP 6144:H6+/tV8E/1E0OrEl4SrruvJp6SRaitECiNHITLVnxbSHl55HMlPLbQf:Pn8E/1EOl4aeJpFECy5Hl5WV8f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmi94discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2