Extracted

• • Target

    Remittance Scan DOC-2029293#PI207-048.pptx.exe

  • Size

    602KB

  • MD5

    7619630836e31219892819641fc56773

  • SHA1

    23ca70fb00964a3059a6838bc906a511741a3d38

  • SHA256

    4bbda63f732b2341b67208a1f237db39488fed540f55ee994a641a0a133ec0ac

  • SHA512

    c7703054434c9c3c2a7074e470f89d61c8455fb466e14a34b436460c1bd17299a5976d87b504a695c52f04d4f6ca9dc4f697a18bc9f8e17baade5bda175467a4

  • SSDEEP

    12288:6+ZRT7+v5UH3Tyzgj3pIXMRg9A1GKZHNYPzodG5hIE8Tv:6e+OH32EDSX0oA1GUKzodG3

  Score

  10^/10

  formbooksvh9discoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2