Extracted

• • Target

    RBIDFTCRADVICE_21012814480386259994,pdf.exe

  • Size

    1.0MB

  • MD5

    192241c16894f7c1a1f74ae037807bbb

  • SHA1

    f4089d984924a4bd5dfd4c72190043d23de24706

  • SHA256

    a9989788c3001149521eb7c42b65c8bffedb52efb1f6e4e08e001b3fe3af90e4

  • SHA512

    bc20dbf398c02dc33fb097db57b51ec202bc0753700df3109518ff4ece2205ea6677f11153cbb562e4b42db45ba373ef1afc6123e2c540a016d9897c0a3182b3

  • SSDEEP

    24576:Wsw4pC6wOo3Jy+p5Cf0+xv7yICOAXr4hT:Wsw4pC6w73pKH7yICO/T

  Score

  10^/10

  formbookcp5discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2