Extracted

• • Target

    Scan 00089877676.pdf.scr

  • Size

    691KB

  • MD5

    911975bbf09185224dcc9ac41aef0d79

  • SHA1

    30b45461b02c47202d3e53d422e6dd2a03f9a784

  • SHA256

    4a16f87ede74f8f5cf4af54e78a69380979b1147a8302cd371d50947c4a0f0fe

  • SHA512

    d889be596835c6a8fb22e7a753ff744f94201d83b2a712ea576edc9f151f225ea9125cbcb7a7f0df122a78dd152271490a96a6aab0bbd1c4e3ed602d21c4d30e

  • SSDEEP

    12288:PUx1UoIG5MPUYjD8mMj0z4vjIvlna0QDL2kq/wkQsu1FJeBsHvM7Sd2AN89kR:EUobyZH8K1wfGkqCsujJdHvMK8g

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2