Extracted

• • Target

    Invocepackinglistpdf.exe

  • Size

    925KB

  • MD5

    6e9319dca3bfbcefce52d8c1ee590b7b

  • SHA1

    80c7c30f95a7821186e8f566c02aea4898e3d190

  • SHA256

    5a5ecb542145e7b9cc78d7f3d55a3b5d5183b8c5e7fb604c35085485127de7f4

  • SHA512

    f4ae7600b94b866bea1935c0d30ee4a7338d1ba1b9b3bec68d2e9bf4afbec57534d882c8d9db03ca5362be48aab6de7009cb832e54306d669ec55884ada50991

  • SSDEEP

    12288:Cd0NmhWSft/ywIYHeRP+cuYWqV/WNyHZGijPSJAjHFHSUw0fedLGL31d8B8dkc9V:w0YhWIBywpUH5bgijq2dPw

  Score

  10^/10

  formbookb02adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2