Extracted

• • Target

    inv300123.pdf.exe

  • Size

    249KB

  • MD5

    c1d715af9940a5e70e1ab58fecc18dba

  • SHA1

    a223f8c86b1748e3f7bccccd13c864507505e09c

  • SHA256

    3b49db8324bc576c3d9e31d4bd1c27af48f3ec36652b95991a3b4803c6a48ad8

  • SHA512

    99fef3200ab3cf200a4d23ed95edbbc7005b856b599a2b832bedf9cb16ffc62dc6f5bc6c073a95e3f473b055621e4e022801c72ff4c0ab818253fdba59cafd53

  • SSDEEP

    6144:wBlL/c/QkZXt5dYUpKdCASZEJsfgnv1KhsiGcO3:CezZJ7pDhZEJggnNceH3

  Score

  10^/10

  formbooks3dydiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nqdipsrotb.dll

  • Size

    31KB

  • MD5

    8ab953e111816f48fd4aab119809af53

  • SHA1

    5ad3c9b13395ea5912bbff13746171a387f43979

  • SHA256

    cb989078f012a4f8f8fe2b0ee20790a792dc6f1968cb0bba55f654ffb3346c20

  • SHA512

    75b37e5fcc1994686eb91316ef45ec46e9ada54cbe985e9671c8e0d09a153ddb6bbfd2881dc278c6b351c6a022d1db6c33b6b7a7ce73b0eb4af5a84ca2e7e421

  • SSDEEP

    768:NwnNXmYszi/iiIQSE1J982EvVaM+eDdeQTl:HzHLQSA382EvVHOQ

  Score

  10^/10

  formbooks3dydiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4