Extracted

• • Target
    PIM_30_10_00193_interser.js
  • Size 4.2MB
  • SHA256 abba78a4679499caf6bb0f1d17dd8816f1b39655e09a2be770a92d54dc4072be
  • MD5 5742824e43f9e8d796d2de8e50c6793a
  • SHA1 0158e7e8cb5d90f2b26928546a03664152eb8594
  • SHA512 f8a6dd2fda135d6ee0072bc4916038d79dfcf81f439ba89ece7c78f18c9bb607c198e771aa81e47792d56acf0f95cef9b4f0a297810ad0b0af674523387e1774
  • SSDEEP 768:kcrXa/tGcNs4yxFcfLFGp156sA+j98gZqDpJkQzgerk2uEUmPfTWpe1nvX9+NZ4U:vDaNsd30+jLZqDpJkPErWpW8NZ4WVu0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionformbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2