Extracted

• • Target

    SHIPPING_DOC_PL_INV_BL_PDA_005958883_pdf.exe

  • Size

    310KB

  • MD5

    22a178e0f16637e45909a3dae9b8d623

  • SHA1

    3965ecc692c69659bbf7b788060ccbe43b27c9be

  • SHA256

    c78a0839956fc39357c153f175811edfc50835093387322e4639156ab1aeb701

  • SHA512

    cbf71fbbaa9817c0ba29bb549590f3e381319ca3bca30c900b3325c141ad8f31ca4ea7b48fdbc9846258a3077005b11e1c56da8fd82bd366d507806f36269d4e

  • SSDEEP

    6144:gacs8c4h9UYI7c8MWCFVaXAs/jiB1fXzW8Qf4QiiIJw:g68cgUYIY81CXaXAs/eB1/iFb2w

  Score

  10^/10

  formbooko7persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2