Extracted

• • Target

    PP-200446-FDA.exe

  • Size

    919KB

  • MD5

    9be9423c9ffddaae3deeba862a7ddd07

  • SHA1

    d7be54756136d3a7becbdace6d964de692a62e9a

  • SHA256

    f0015592877dde5dfcd0da20d585c611c5b8c2ac9a66b794d4cdc882014f2b76

  • SHA512

    a9daab4511d2208b3894a7709184aa3d3d89ec9c36f722d4958573f63c00b7e17270361078a8164b2a90ec1c72129b72dc2670721479434ae057addd0be06c0f

  • SSDEEP

    12288:mHyDZHdP+eCSmbT4lwVBWVow4T7twjFl2w8fRMdVjbfdvYrGvwthL8GOvgetMUIk:PDFCt8lwrk4qhkwqRMvjbl8GotFa6QP

  Score

  10^/10

  formbookpy25discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2