Extracted

• • Target

    payment Copy882pdf.exe

  • Size

    682KB

  • MD5

    1e16dc0a62bdc864d61277defc19c599

  • SHA1

    b72b8a5d8421450cae51b53159fc6c8862f6bc8f

  • SHA256

    60ccea072df0c91b1b0f2cc18a88eff5e373c68f4d13c7d93e66fb17d211ec9e

  • SHA512

    8f3dc3cd5af8c27a4f8221c6463c9dd95fac544d25dc6103b3d9313986e0f506fc5ad2431d15e2e6846cd00555d1bf278fa320aef8a230c7fe548219ddf3d117

  • SSDEEP

    12288:1YmgrSswecl9v2l+FiGQgG6AN1RKLYvvfK6vncTsEdoGs22zImsDHTndj:Iwea2civgGbxK03fK6vcThdopIJjTd

  Score

  10^/10

  formbooka02ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2