Extracted

• • Target

    potvrdaPlacanja_229523624_NetBanking.PDF.bin

  • Size

    650KB

  • MD5

    c2cfb3eba8906a6709e2f4da166494a9

  • SHA1

    3fe5fa561c199d0cc4e361714fa503c0062b8b94

  • SHA256

    86579758583cd17bc1bb28d3b4b0cfa6a6996a54595db68bd84f3e1c69fe6d30

  • SHA512

    defa95ecfa347c5b0e258085bd01a3c2d6fd5a0bd6a4e6ba287c51cd522017da692136d5cc43fd42762165fbf7fd300d2c6b3d590ef34e7dba9e2f3bd68c18c2

  • SSDEEP

    12288:UQDWJkhvg8m3T0o1uMehVz1mOW0KWer+Y2C6ek8AsU01/9Qx2uyjy5tRUe92OckR:eGyD0WNW1t4Wer+Y2C6QAsn1Qx27Q

  Score

  10^/10

  formbookdn03executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2