Extracted

• • Target

    orden de compra.pdf.exe

  • Size

    714KB

  • MD5

    f8c2ed068b19751db85c91aeef0a3c40

  • SHA1

    e3ebf312f0e7ef027246c2f6527cc8029b257d90

  • SHA256

    6ea29798071a1323ec1298b4d1f5aad63318d2c685637239b9d67768744c7978

  • SHA512

    a5094444d4608b8bf51a765875209816645758bcd1003e65f7e3ae32c64a3f6d021973ef84976ee86cc3b0f1606c5d288502fc96dbbc517501b38cbdbf6471c8

  • SSDEEP

    12288:KTzDQZ8Lx05Kh4qpgZ0o4yPuasknvGPiGwc6auan4yicWApbMGlg6:vZ8NSK+qKAaxn4Twvan4yjrMG2

  Score

  10^/10

  formbookd2g7discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2