Extracted

• • Target

    File34456644pdf.exe

  • Size

    650KB

  • MD5

    d3b75622f7855cdb9f3eb8deaa37f75b

  • SHA1

    6703d2b4e4f9c32224b9aae4a9c5a96844275de0

  • SHA256

    73c0f45b365444e09376cbea6f71b5f877af98eec65f809a6b078f206a6d4430

  • SHA512

    7e44ef7e8f50073083a161be1c80ffbeae7449273e08e64f0b7069abf8210a7c3d8d26a3164fe7540bb0c8105cf124cf61421c67c1fc68b1bd39a346a000b31c

  • SSDEEP

    12288:+nApngDxqg/9CUfvN7uGDJHD8aHQHtpIKzTHucl7Xbqold4tpMRM:+n2ngcI9TfF7uGpDhHQNWK3VlLd4p

  Score

  10^/10

  formbooka02ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2