Extracted

• • Target

    Payment Confirmation REF No 016747 PDF.exe

  • Size

    253KB

  • MD5

    321ac4a7c104daae261c6ce5ed12db5a

  • SHA1

    2cf6f37db30b5bdd5b3ae338a4e209c9ccd0f984

  • SHA256

    21ccf1fad3e1a08f580d5f0d5aa2d13fb1a633aa1c68100d435628a437efb89b

  • SHA512

    35591b1d584daeda8d6997224c6b3edb666f8cb8b7a77950f7411ef6bf030d40b8308168500a12d7f8c503113ba0e870abed8192807f679cfd90a317cf9f03d7

  • SSDEEP

    6144:PYa64mTIQqcpm2VNUmdzdr4AiO0iijUg0SkuMPnGKY6X:PYOmTtrVjd2liijUg0tuMeJ0

  Score

  10^/10

  formbooksn26ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2