Extracted

• • Target

    Payment Copy88382pdf.exe

  • Size

    686KB

  • MD5

    dc33f885728b308c7159ffd95a728331

  • SHA1

    45ee3cf5a16ed7770a9e78bc2d09294128a38e6c

  • SHA256

    78e8787616a4d7be2eb5c127e75e3326de2c3e2dbf2a2533163f9594c0214b16

  • SHA512

    929e020d609a8e3d065df62f978cf787a60e63629d6d28eaf287a2f1b3b1e30c4ffb67ac509d26e32623087c3a4665f46067e0c1f36423d922f5d64a49779910

  • SSDEEP

    12288:5RYpw+u2yCIxGFvNUuqjL8nk3iS7bbRVXMGeUbE0X2tpXEe2nBeZ5O6suWb3L/KF:Q91IQNNUbonqnTX9eUA0XAUeiE2

  Score

  10^/10

  formbookb02adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2