Extracted

• • Target

    Maersk Scan Docs.exe

  • Size

    516KB

  • MD5

    95c48652559f05a64085bfe6e35aa29f

  • SHA1

    29b0c7589cb4404815c83a033c2b87813387e9b7

  • SHA256

    f1def9617ca9f7ac437dfbd6d67b37af2779827c2c66b89ac80b6f6f6279f173

  • SHA512

    95260fb7ab3d104869c3624bbf030f626f31eac4305964c71340afbe9b837299b180e5af0129f155869cc1743fd4907ca123a7c98b6f04ee8c74246041e846b4

  • SSDEEP

    12288:ucmcDYNKgACB6CK8bWOuqynw0+je1syX/OycmcD:PDUn29qynw0+j4lX/8D

  Score

  10^/10

  formbookchdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2