Extracted

• • Target

    Ticari Siparis Belgesi 07 08 2024 18545075600_pdf.exe

  • Size

    621KB

  • MD5

    0b5d663eec3c028c096d5b7b9814991b

  • SHA1

    a4a9e6148e8eb3f1909ac9a5d2f176eb690e863e

  • SHA256

    98561472f0008145e959e31a6dc3f196f1fc6f05a938ab9fc8900c15821e0a1e

  • SHA512

    8f5b7e4ef0b0aa6cbc6de1f8e11453fd3b82b4082e4ab11a76cfdc74cf162ed7af94c180d36b1703b3feb83432dc202434b402057e5a2a72cdb6e2e36a7bf117

  • SSDEEP

    12288:oP1z3F0/F2utHG0cfTUoMo69Wx/Uc1V3MJefTBBxJ5GM6DRU0js4:oZEAmHGpQo69W13Se1Jl8xjs

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2