Extracted

• • Target
    payment Copy882pdf.exe
  • Size 682KB
  • SHA256 60ccea072df0c91b1b0f2cc18a88eff5e373c68f4d13c7d93e66fb17d211ec9e
  • MD5 1e16dc0a62bdc864d61277defc19c599
  • SHA1 b72b8a5d8421450cae51b53159fc6c8862f6bc8f
  • SHA512 8f3dc3cd5af8c27a4f8221c6463c9dd95fac544d25dc6103b3d9313986e0f506fc5ad2431d15e2e6846cd00555d1bf278fa320aef8a230c7fe548219ddf3d117
  • SSDEEP 12288:1YmgrSswecl9v2l+FiGQgG6AN1RKLYvvfK6vncTsEdoGs22zImsDHTndj:Iwea2civgGbxK03fK6vcThdopIJjTd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka02ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2