Extracted

• • Target

    SWIFT pdf.exe

  • Size

    687KB

  • MD5

    2c108e76865f4f65725c9f3410c87cd0

  • SHA1

    0c3776f261d22cdb975e3faf7b2070b0febb3030

  • SHA256

    124a32f23ee38371976744f5787e82d923cb0d2a366d75d6ca74a9a774a74a23

  • SHA512

    7c3c1ce1321f0672b6f59b43f670a479506353b2070b207ead10338d65c21fd9b05ab862904c42764d796208527c7c42576d370ff3e47e82b42687afed8ba298

  • SSDEEP

    12288:/Y2qghb7wmWrBpoMwnwVrG9R6hUBB3PaRHlOGiI818efoXFYiqp:w2dbK3xwnSrZOa2Gi3HoXy

  Score

  10^/10

  formbooko10cdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2