Extracted

• • Target
    Specification and Quantity Pdf.exe
  • Size 1.6MB
  • SHA256 219a330b7ae9807411d289f28169861fc748f50212ae2317278bfe155d89990f
  • MD5 686fed0af9eebb2581701d4e08e9ff0b
  • SHA1 3c9f400ba8c6fe7f35f20bca09e59d3bb8169035
  • SHA512 178d525f08b12ccca7c2a11f230e4bd83b74d28d17f15c13696937f57e4272aa34b0542aca6890e032ff7d4732be426ef00dcc54adceb70bd71f05cbd6d6bb00
  • SSDEEP 49152:YAodtaG9kS2U84B+FLan9k5TRM9zlxVjZfjQq:I/B13fjQq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookn7akcredential_accessdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2