Extracted

• • Target

    PO.41022.pdf.exe

  • Size

    1.1MB

  • MD5

    611cac35588e905fd549327d435c80fb

  • SHA1

    f6871a3d076f654bd444ddb5b463ae59751c2236

  • SHA256

    714e4e1608cc5486e6ebbb112c3dda90ce2398d346539ef636adb31d5268ee58

  • SHA512

    2a947a119e143898dafae97eb353bdb18b192a27bcc1fdc224c3960e234fc4a29bdc0606cc53006eca3315665af072bba9542b0858a19b2dc7b20a3d7633fbe6

  • SSDEEP

    12288:sfaK4HTNwJ8KROwE4n332sIxfc3jnTVtjtTLnDTOBPtJ/WzAw+HUzPIvuUa6XyGx:IBFF2sJznT7tfXODJxt0zgWyzWhj

  Score

  10^/10

  formbooktz8tdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2