Extracted

• • Target

    Pending payments.exe

  • Size

    772KB

  • MD5

    96df83409286c456fa56c37a0d5098be

  • SHA1

    9140c707f2e625caa4f300ccbc2c1f7136048b64

  • SHA256

    1dab7f07bfa344e601226bc0657decbabd3b421fd207e031ae99ccfbc5637414

  • SHA512

    3ea8150f356a1ba5ab75f6d49db8fa7e0cc86aa850575f605df308de4ba9248739745f5ade53135ac5be167abeb5246b0452141091a3665f0ff19f09e806557f

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqLv/ZbzqgYP1Q7aem6GKxA4ElbxKEfbOeuOU5Km3awZ:tthEVaPqLv/Eb2nm8VEHffb/U5Km3ZkG

  Score

  10^/10

  discoveryupxformbookc89pratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2