Extracted

• • Target
    z16REQUISITODECOTAÇÃOpdf.exe
  • Size 673KB
  • SHA256 d58c6fee983f0750aff8aa614888ea36c5955f87f88010fc506dbe93daf736e2
  • MD5 a464fa61a47ab34200042e4e3c026acd
  • SHA1 fd2883b7c7aa669bcb53639a1c9dd2e0e14423a2
  • SHA512 1d34cf31dd387abb7f85a5702f57b6ab6e888058c8af292e29d35d5d92d4bb2d04056f6d1a9db9cc10fd31befd66959987560fd84a12a1a817c0bcaf9d83cd92
  • SSDEEP 12288:xhcAoIFFHgeg/civPzG8i7e5WFxyu3K4tZLXVeDofYT9IjV+BK:xhcAXFxCPz2zFtVeEfYT+jV+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookgy14ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2