Extracted

• • Target

    нова поръчка pdf.exe

  • Size

    689KB

  • MD5

    543fb196348fc3dc47731e7480b55476

  • SHA1

    2bce42c91d767bef6cb05f511c54e73e5d06dff9

  • SHA256

    06d1d5e5a8e641a62df3b3282dc437d24d48a31cc60f691c760023429788ec6c

  • SHA512

    1deed8d33159c1fd02534de98a6411fa9c129b4aea1d941d1e8dae002f48edcaed73ce38c49598e9997097ffd828d02a53661a19b4e6530198de62bd28296748

  • SSDEEP

    12288:RiFtTLMIhPTv0IWZIf+KLlukv4XA7mDiO6FFIGnWq:RWTbhPzaIZLMxA7mDiOKQ

  Score

  10^/10

  formbookg10ydiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2