Extracted

• • Target

    nfattura scaduta Pdf.exe

  • Size

    1.5MB

  • MD5

    0d4b25a33c69e4443f28a43ae3b015c9

  • SHA1

    92267c25dc62805bdfff9497174bf91feec90f2c

  • SHA256

    869eb1b44b9d5e0ee5b99b1189edd21d706c58094387ba32ebf2aa45703a9c9b

  • SHA512

    f628aaa5e739534b6e7833f44ca96e3a83dc83aac026b0f75c3919e937ed468d18764f1b2347995822e98d3eb6c6797524c0c28d4c6371f3a9c57dab0eac9e1f

  • SSDEEP

    24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsNbJZ:rbGWAJeDingti8P+TwSNO0n9vwbJZ

  Score

  10^/10

  modiloadertrojanformbookges9persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Suspicious use of NtCreateProcessOtherParentProcess

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2