Extracted

• • Target
    PI and payment confirmed pdf.exe
  • Size 1.1MB
  • SHA256 cd0dd222c7ba110e49ecd0aece6fa2915b5a126fed2fcdae12e114106688bee0
  • MD5 3792577ce38a71b76108056762bbd911
  • SHA1 64b79ede261d1b7c4be29b654d49df1b9ba74b17
  • SHA512 c839c739579212985b8c9980f27a1d5fc7e46a9a578765cc888aea9475af3cd237092828c6aa1643347d5a93448d8d8c97bc65448857d00f559a5a7cc54429da
  • SSDEEP 12288:RtVsGMuG7PS2wDtCU6NdObmCORJqKqMQZLGdVNXbUWsK9h9wAPft4:R0hOSNENCJqKOGvdUWVJt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanformbookn7akpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2