Extracted

• • Target

    Nov.pdf.exe

  • Size

    634KB

  • MD5

    406a8800ac851d7591b9faa57c7a540a

  • SHA1

    62df23d861119dae068567ed47259c44a9121064

  • SHA256

    714c331c290a9293ff62b5ef61add6cdc8d33043b2290c4e422f18ade08a513a

  • SHA512

    51e74669a8e11ac12409a61828d283747e20b9f439db9da158232a44c7ca9aff6d2aafa8506791566e03df44c36251b612daa9a8dd0eebeadc6ee338ed2a3ffa

  • SSDEEP

    12288:WBpCdKYpMlSGbv567mWTWwwjENXl+6vkMFfVIQZWaxyc0d1is:MMQYCSGb5cmqfwj61MMFfVIcycA4

  Score

  10^/10

  formbooksqxsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2