Extracted

• • Target

    z19novaordemdecomprapdf.exe

  • Size

    580KB

  • MD5

    90a694e0439016ad06acf7f18fd459dc

  • SHA1

    3e32249a1109d2ed4dbb18fcf07c89f1f48b136b

  • SHA256

    0aff2c6f129379862afc597336ecd2cb7e735d7163e7ed75098750e5679ad758

  • SHA512

    c3cb4d506550ff3b24580c59e3d0a2c8d61b09aee72b04a41a926fc1dac7ee95d2647ff3d9552debdf590f655afade38b685ddbf6d52f2ae83030c313fef042d

  • SSDEEP

    12288:Rkf0j2LkrPMx6TSEr4DONu9t+5zStgeXw6RubjMCO1wC:Rkl2q6TJ4DnuzSaTbjMCm

  Score

  10^/10

  formbookgy15discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2