Extracted

• • Target

    PO Contract pdf.exe

  • Size

    769KB

  • MD5

    e4c95a9654a8a1ffc9c2da8de3299258

  • SHA1

    8c1e4834df81da77f7765ebc431750353a5bcf9d

  • SHA256

    57a78347375504df5a96e64875a08d287088b2392a4d69e0357f0ede1895b172

  • SHA512

    7795f7cf717691c3562d1852cbcf96bbbf58673665e77f256c17f0f5126fd3a41ec51483e16d32d40785a0ab5e61a7539ead7c2294803c38813f9cc1e383abdf

  • SSDEEP

    12288:dMVUhEFIPAer9o1V7oXiNH6i5yFyMuU09Cq3InWoLZ/cRts:nPtr+gXiNH65d7Y3InWoLmRts

  Score

  10^/10

  formbooko10cdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2