Extracted

• • Target

    REVISED SALES CONTRACT _81773291-4SU _ PDF.bin

  • Size

    645KB

  • MD5

    c3281495a49edbf811f733f22553dc22

  • SHA1

    b0d1a4e2d5301a83e0233079ee98895f6b0ecd53

  • SHA256

    7233b29d1b7129ad7c3466a94f7e608ab6673335dd4654063aab1d0b5422e973

  • SHA512

    91f8eb526b13779529467cc02aa20a1889515682a6968ff97871c8e9a7da2a5518d1d1562d824b7744b65e3e1d235d1c0b5b3ce456c65be6fedfbebe9b70387e

  • SSDEEP

    12288:6cwtKGfPSDKDJwrnixtgw1Na3i/PLa7wTJerx8CHH4WD/Mz4iVQdC:B3GHVJw0tgSsUPLCuJkp7rMzFx

  Score

  10^/10

  formbookstgdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2