Extracted

• • Target

    SOA.pdf.exe

  • Size

    599KB

  • MD5

    2417cdb09f72141abfa45cb64e699d91

  • SHA1

    1ddc6b218dd520915ba8933e8214f307387b0e13

  • SHA256

    331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3

  • SHA512

    39e83bd1bb9c0a2d529216ba75bd5ad15ebffb836c188e2723633e58203d2008ff6efb3995b51209992eee3120a36852939925d0282b4b218ceafd0c98f622c6

  • SSDEEP

    12288:Hiu6oMr21DjiSdBaLMl7kKxYBQWHm6ayJNMH00qLsPBUr4wtJ:Hi/KDjJdPbyvm6DrMHPsLr/L

  Score

  10^/10

  formbookfs83ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2