Extracted

• • Target

    NUEVA ORDEN DE COMPRA.pdf.exe

  • Size

    735KB

  • MD5

    31ba1b0840c21eaef4703f971d6e1269

  • SHA1

    b5775b488c52e6e3213178cf3029f670daf3ea61

  • SHA256

    a1d866af56e776900262c65bc9f7396338f73378f7af889c5f02166432381097

  • SHA512

    6fe6a5e5df803f021b8140c017d35d96e3ba6b2d83c67342edb187a85c2c8e031a8e5a82a4ad96b2cb648609101224c948798c4970e2227eebc82655e4ca027a

  • SSDEEP

    12288:FQGaZqPVeqKmpPkHpgnrnHvoXZJZE9NzxIbkaVF4Vp9xCwgaNSsRPTJmeZ:SgteqTpsJmwrZE9NzAFep9xMONPT4s

  Score

  10^/10

  formbookd2g7discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2