Extracted

• • Target

    Payroll Overpayment_pdf.exe

  • Size

    693KB

  • MD5

    dc0cf0105719f618a1bc3559f392346c

  • SHA1

    d3ce0d937f4014e94be5b4ed2f6aacfe36feb634

  • SHA256

    68f9c7b5496c4d7699179f8c6f7a79626a03da699cd1986036f03af725218c45

  • SHA512

    ce3b00a37c1450e87e819121c5370d324e631dcdbdfc01b0c4e4c76f340caa8e0bb1306a4f18a79b63955a3641f8f0ddcff61fda4be8fbab10b8a1d9a9dc8ded

  • SSDEEP

    12288:JWzlWswecl9+1C/CiSxZcoTBPs/GZP6xvh0pbFOgLLYEAl4bhwSItprbkjkR:IweL1HicZfhs/J0XLLJiAWTrbd

  Score

  10^/10

  formbookg43mdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2