Extracted

• • Target

    INV-7182234 PDF.exe

  • Size

    713KB

  • MD5

    62ff7b0794ea1490f930958e19d6a26b

  • SHA1

    6af133db25d9f2183877f7b094fcda32828b30d3

  • SHA256

    167bf768c164ac7181b18d6ce91cd51f7d3cd40470a8c8f67bb4a8e2bf00b65b

  • SHA512

    4e923724d2890cdaa5f652d5fa12d31713f8e9dca9e18eb07e76c6679b1498c513b86b0f2d81a2a0c1905779f068655c889333252d4ac9714222aee42130d126

  • SSDEEP

    12288:uXqgHEGTXTI86bB7o5qwTW7py12qk4h7zJdpDj2UnrbSmnCFdfZtL/wgGgOUBZqQ:uXqyE8s7tck6xP2UrbadZtp

  Score

  10^/10

  formbookgc9discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Purchase order 76353 ALtan.lnk

  • Size

    3KB

  • MD5

    b4595b72f1d67c6062fd286be15aebd4

  • SHA1

    87c2b6d575baa07f4d13a3332c8858983dbc3284

  • SHA256

    55756cbf17c39876ec3bb2ca836ea9b55741622aafd3237d9ef2e971502d0d29

  • SHA512

    16bd5d57e5e83d3f5f7202744063c6d7c05be69425b6758997c2f53c893d720809fb793639f7dde9451c3c3c1f409de8e3d4ebe0861bfd7740491cf74137a1b9

  Score

  8^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral3behavioral4