Extracted

• • Target

    OVERDUE SOA _pdf.exe

  • Size

    733KB

  • MD5

    7095e01e6bf3655a8b1d1449a91cd195

  • SHA1

    59bcb0f7b17b4d6ccb6efd8f3a47a5bf6f1b2268

  • SHA256

    cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba

  • SHA512

    ab6444bc46a4f037ecdce3b57b9f92732ce17e4034e9616d067c6148bae34ed3bfeba4f6e2b2aee2d4391cd679a0737e4fabaf0d0c940ec0b22bad167e501a21

  • SSDEEP

    12288:FoQyRAvxF72mzaRZJvfUAp2F0Fthci5UoiKqBLXpOi/8UOkWTSWK:sSxF7HzaRFpA0X3viKk5JsfSz

  Score

  10^/10

  formbookbi05discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2