Extracted

• • Target

    AWB_Ref509428922pdf.exe

  • Size

    633KB

  • MD5

    573c3aa20cab92c93663f0e475323557

  • SHA1

    647598a3a90b23787b83f0c23ba26a8b4b779592

  • SHA256

    9ebea5ecb5f86bccf0564f563a35665876e5bcb1b66285a19965af5f24534b4a

  • SHA512

    06fbf4dfea02ac62c81c9e47581d779891e2da9113ed45f349af2e4c52b86da9701a807872a5cfc059c5553de63bab3a24953a06a63d82cf8bf877c3dc538694

  • SSDEEP

    6144:WTTzzJeyp1RnC7HJnIApeX9vLSaXmWFiB3WOk6f7h9WgFER0u+GIIIIIIIhIIIIw:GTzNeypHnC7HdeXZEWFTOk6fmBm5GV

  Score

  10^/10

  formbookgt23discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    tier0_s64.dll

  • Size

    412KB

  • MD5

    de738f87b7a558476d73d590ea20a3b9

  • SHA1

    ea2da2c8b5c811ea798805d3e77250f12cf6da76

  • SHA256

    87b2d5cd0f667d8f72468ffd146dcf2aebdf7e65db575c04ffe6a4df9c1f1850

  • SHA512

    934a24556d0a4dd7643c03f96cb057ff25bceecbc9795c4a30884aecc5afd441fa99bfe0d978c8879f3fb10260373f055731f51a18775c55de68fa716bccb81b

  • SSDEEP

    6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB

  Score

  1^/10
  behavioral3behavioral4

• • Target

    vstdlib_s64.dll

  • Size

    10.0MB

  • MD5

    897e2193493cfd989d82f6a559bf1b2a

  • SHA1

    df837bc19bf863ce466588ca3121fed884922b90

  • SHA256

    92958c2e2d940de78a7f5352b00890f291d568816a8fe1b2bf8c572941644ec0

  • SHA512

    761d12c8ebf7df3bbdc7cddf1220065a4e13780057c99b2e43bd653f1c00154ad9e1c8f2236373d54c985ee710c8847813223d244ad170c678593b3ce8e97996

  • SSDEEP

    98304:nt/DDvVWLvBmmZCPPSVHxySAknm58mQzKSawKlhW1TS28kvGGp:t1WLvBzCSVHxySAknm58mHw6hKVGGp

  Score

  10^/10

  formbookgt23discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral5behavioral6