General
- Target 29062026_1626_29062026_MV_VAN_KNIGHT_VESSEL_PARTICULARSpdf.Gz
- Size 2.2MB
- Sample260629-ve3slsas2s
- SHA256 1fbd9f9aa1359e8b4e1e33d61b8b61c4aa676f8614f09334c8774b0af512fd77
Score
10/10
Malware Config
Targets
-
- Target MV_VAN_KNIGHT_VESSEL_PARTICULARSpdf.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Accesses Microsoft Outlook profiles
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of SetThreadContext
-
- Target Secur32.dll
- Size 2.1MB
- SHA256 f8a7fd3580f7a79db3be7feb8f1519e38058977a7b50cae698260a487e815475
Score7/10-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1