Extracted

• • Target

    yeni satınalma sifarişi pdf.exe

  • Size

    648KB

  • MD5

    f6c598ab4237783db043d7403e6162bf

  • SHA1

    3a857bcf5284daaa02a3cab9836093c44f2862d3

  • SHA256

    7029429d1549acb4881b5c44db069decf651f366a9b82c58c85edcd1f6f1b352

  • SHA512

    fae99fb9ec397365a9ade59dd2f429deef814009a2a6230f6f79ec3738956108a6660568aa4bb1a6b7de9858d7db5570d2387385182aaa7dc78713e608c885a9

  • SSDEEP

    12288:sPagE2qRySy0TEZ/xOoC70vjUUJDhMgEL4M8k22yJ3h:sPaHRySyX/u70vjUqDh1lGsh

  Score

  10^/10

  formbookgy15discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2