Extracted

• • Target

    nowe zamówienie zakupu pdf.exe

  • Size

    789KB

  • MD5

    878c699efc0860285d3ea8edb0aed7cc

  • SHA1

    6aa036104ad5163851dcb3da1e8aaad3ca188a05

  • SHA256

    cef7d88f9ddb7a30478aa00624340d206b0d84553d8ee969178d8ed59cea3033

  • SHA512

    98da4c98cd890def9d125bf916feac7871d183ea0abf8e22a56703eb356b470135c4458074c0c13cce72d60d043bddd4e373d51e8e067bb43f7d69b2c37cbb08

  • SSDEEP

    24576:BQ7fRrVbCx3YNuvthOyMqiXKY+MZVwbuEZ5:QRlCyu1hn6Xv+MZE

  Score

  10^/10

  formbookgy15discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2