Extracted

• • Target

    IRQ2107798_pdf.exe

  • Size

    680KB

  • MD5

    82bd4c01ebb56d4e838dafea4ca369a6

  • SHA1

    da828300ae92f1ff46256ee8083d1b11a5f1e352

  • SHA256

    e0c7519f48b2a37fca3ee1407808121685915fb1243a1ba217ea1663f9119ffd

  • SHA512

    cb9dac5456d02890952eb28efd4717520bd60c8a171dd34a1cae30dd6fa55e3afecc41e84de54fa5ec377b16866021d5eb4a33478c8498f77898fa306e2e06a4

  • SSDEEP

    12288:6rXpUSlB61512158AahA4wk3/ZnxMTjDdiWA9izA4pBqXodAtOlazgTSFcDXQ:sXpUSlB6151215H4A58RnxMTXNqXoUPQ

  Score

  10^/10

  formbooksn03discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2