Extracted

• • Target

    Inquiry pdf.exe

  • Size

    517KB

  • MD5

    cb03eb5391971119bf6f81acbb84e1bc

  • SHA1

    b5f050d050f9af0b4d937514935854c4e52f3eb6

  • SHA256

    cddf575d340c695e513d03330965f716f8ddf17f5d2fb0929fbb78875653d8b7

  • SHA512

    d654710622e0781d4119f894a9ab6677a72b20ef2c4d3784aeaf4dcd34b47e2861008be15d3a8d474b8b6b82b395a337f14b05ec470433fd8d8d694315b6d8b1

  • SSDEEP

    6144:HBzy0/iei9k8mOalFu027X1mKjlpBFR+HPdroDJ8t3T7UmhCCT3dIPSH6MKghy03:PZi9704x/mHJoyx7Lhr/zDEuua+/o

  Score

  10^/10

  formbookbftdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2