Extracted

• • Target

    0133_3674633_83637598_3647,pdf.exe

  • Size

    1.3MB

  • MD5

    c3f45e9d88589b1ff6a362dddd17c55d

  • SHA1

    92d450501abdeb9148dc5ae2fcf20cbb98451d12

  • SHA256

    c9ccfbfa367975e9c021bb6dc0d0bd42b31922c328a46d8547e28f11c55c689e

  • SHA512

    0e539f253b20c1a4d59a5b44e0417d18e22f58ca1f4fe1118048c47f05d5bd2a672d7aafb63ae8501569840f98e04d61e6e15ea35fd942c903612e516b938062

  • SSDEEP

    24576:/7E1X+6AX8B26SLmfpL8qn/ytBgXfKnks1qUhVJR1IoIhI:/uX+6Ao2FaL5natBBnks1zLR1IoIhI

  Score

  10^/10

  formbookch24discoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2