Extracted

• • Target

    doc06520720220131121555,pdf.exe

  • Size

    1.1MB

  • MD5

    b274a8db1f2759a5633feda3ebb76e99

  • SHA1

    bb145758eee0923a3b5fef02c300fe631855bbb6

  • SHA256

    cbf712334783e060e67ba77d675a7402efa44b879aeed5b56fdbe9f2b01ee99c

  • SHA512

    8b070b4686d60f7cb26e77451975bc1cade564def98b92077db90b6202a2439857e9df95fadf39064e717acad6fb64dc0065b1f0e4ea9d126f223fb7ac0b3471

  • SSDEEP

    24576:eYhos91WO8ZCh9/9D/bLWLcygotSl2G6PrOTg0cm+pS8Yx:7hos91N7h9/9bbLWrdSl2G6PrOTg0cmh

  Score

  10^/10

  formbookch24discoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2