Extracted

• • Target
    PO_331602024.pdf.exe
  • Size 638KB
  • SHA256 c3eb2319b3eccfd5647874f29208fa00d0d72e91a78128c69c2f9d58cfafbf53
  • MD5 dca078fa91a1b2a331bc2e976d56f2e9
  • SHA1 3813e32988072c056746bfd6bf329b200297d05d
  • SHA512 fdda76fc074d27270ab4351fa98baa4e63fbc03f96c7eea8b88e046fbfe50b5785861c2fa1b4cf1aaf3cf8c2c5f801597a774ad3639e83f62b9cace2382e7ca7
  • SSDEEP 12288:m3IU8S6eUdVqXsUOhr9BPPeNlyKzuLrpcacn09olMbf5rMTpMpVyFJ4d5:cItSAdmsUoBHwlVCrpf66o857EF2d5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  zgratratformbooksy22spywarestealertrojan

  • Detect ZGRat V1

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Formbook payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2