Extracted

• • Target
    OVERDUE SOA _pdf.exe
  • Size 733KB
  • SHA256 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba
  • MD5 7095e01e6bf3655a8b1d1449a91cd195
  • SHA1 59bcb0f7b17b4d6ccb6efd8f3a47a5bf6f1b2268
  • SHA512 ab6444bc46a4f037ecdce3b57b9f92732ce17e4034e9616d067c6148bae34ed3bfeba4f6e2b2aee2d4391cd679a0737e4fabaf0d0c940ec0b22bad167e501a21
  • SSDEEP 12288:FoQyRAvxF72mzaRZJvfUAp2F0Fthci5UoiKqBLXpOi/8UOkWTSWK:sSxF7HzaRFpA0X3viKk5JsfSz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookbi05discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2