Extracted

• • Target

    proformaXfaturaXpdf.exe

  • Size

    1.2MB

  • MD5

    703eeb530cbd41d86e20113624a18bd7

  • SHA1

    997930463f0362f53c5f9ee26afed94eff148505

  • SHA256

    90f18e453ea2b0c1fa4d84d95499ab3bfd11db81a54caa2702cd3749f62c9dec

  • SHA512

    89c1361a73c963985db922ec7d72e670f42eb09a2deba287ad535b93ce5e1c30aab53ea1a4e0395346b5647f060ec6f56650cb302d5a5db54d1e5fdd7a314e49

  • SSDEEP

    24576:iFoEhCKAXS/1+O9P1Bza+78soKoxm5OST6Iytld3BIwbgKcQrE/k2+RVN:iF9ii/1+O9P1BB8soKXx7ytldxzV

  Score

  10^/10

  modiloadertrojanformbookmsevpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2