Extracted

• • Target

    Nuevo orden pdf.exe

  • Size

    1.4MB

  • MD5

    5c73505b356cb427ef1817910a9d8c8d

  • SHA1

    e9c18e17d3701db467879f83e0bf71a98a35c89f

  • SHA256

    877609ad75eb29e1b0813478089df76928fabbaa41538c10f08b4497a2da9f9f

  • SHA512

    27f9fe8b7069d8d5ace439d7bfc56f02930d0a8cd24e470c17585365600084d6e6912556b5b2317155ea03828e631378651438877cb2dff69da3dfbe187baf29

  • SSDEEP

    12288:mwnPf8auHABbBXRzwHAMauf4WhAjNzDy8jXz2Vk1tNpTH2G:B9uHABZdwHpr4Wu1RTV1tNpTWG

  Score

  10^/10

  formbookgy15credential_accessdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2