Extracted

• • Target

    DB0MQH2W1 PDF.exe

  • Size

    710KB

  • MD5

    c9de4efbd45443689be964efe4c3efeb

  • SHA1

    29685a41001337c41765813fec0f08051869a9f3

  • SHA256

    c48fc76802291b6dfc8a465f7f164bf9a96c547442159b47e1f3bbca43e38902

  • SHA512

    d13ae5fc2f8d5fb6f48185cf3164ea38ffff3c22652069befdaef7693ed8249b1e1e0a093286a47aa05d59131e557ed95bd5b25e4fd2c3bf4e9ad1e101a6a85a

  • SSDEEP

    12288:yTFYJW0QysGxLuyNJwFyf5LzSpTC471YYig6qIT3sKwQ4svzfy6ExoPkMG2AK:eYJW0QyhwMKTCaSoIT37wQpvz1yocMf

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2