Extracted

• • Target

    dekont.pdf.exe

  • Size

    689KB

  • MD5

    e5030819a8f2a25db1d44af66e00f397

  • SHA1

    af2a32d408423b80f5bc659f708ff373947f633c

  • SHA256

    d6cb94e803a570db4987655ae100b9dcca4ca11d45c7a0b9ab004f494855b1fb

  • SHA512

    f7694edf91dbad898f73338eb9ce1166e3fec240f0bd700d97ad8cc9455c15805e36d73d607976185fa8559b5b158490fc82fd6fbd73cdf4ecccc5f80e9e2138

  • SSDEEP

    12288:1bJbQWSL/h6HWSpws2t0dAWT9ymEtboOCJVMH:dJbQxLQHWSph2t0OWTgmENoOCJV

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2