Extracted

• • Target

    ORDER_1105-19-243537.pdf.exe

  • Size

    572KB

  • MD5

    bcd813a5df020375578f7c243dfc0a3e

  • SHA1

    18235f9e38482e7e55714d444e474a981bd038b2

  • SHA256

    654807fa7512e651b73910dab8cc520f40a5ebd3eedad72c7882b1a608fd0f8e

  • SHA512

    b522deeb7e009952df95558d8bfa013ff723975d15fa52cdd95e6b6de0a192c407cf2a245a809cf5680df0bd915786364cdc3f4fb7fcd569a47a91c14dc93ad9

  • SSDEEP

    12288:3HOD40mNJF7R9wPYTOdoPS6Y3kzl610xUob4chTgbqB5QBlLkoQsIjC/Rair:3uDoXR9wPSFPDlt/mqsBlZJIjEv

  Score

  10^/10

  formbookrn94discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2