Extracted

• • Target

    Scanbudget.00543647.pdf.bat

  • Size

    620KB

  • MD5

    ae8ca2a7cb793758ff88dee979ac1291

  • SHA1

    d1892e62c48e1d184aed4e7f0aebe4851a8db0c9

  • SHA256

    57c00a4d8594511f335f5b1664d9f681e6803a50c0f0af72dc92f0428ed76fb6

  • SHA512

    07d9157d17230b3311556e726f728193606b4225bdb4b5e6137976d9a19bb564b4f0a2c761b67d44da31ff7c4df49f05a233defdb2744e7ec0c1d1fd02013752

  • SSDEEP

    12288:iTt8JwIF8Q+aYDlQYik944YQsmb2kICDdH7/5fHO6vP0gkR:Wt8GIOa/R4YQsmS9CDdHVm+PE

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2