Overview

overview

10

Static

static

7

order_pdf.exe

windows10-2004-x64

10

order_pdf.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    order_pdf.exe
  • Size 499KB
  • Sample260801-ple28saq4v
  • SHA256 ce77e7ab25929572d8a2bf30be4216110ec2235c9859e160ec207dae38f788b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
formbookxxaspackv2discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.9

Campaign

  • xx

Decoy

  • avricotprint.com

  • wiregalvanize.com

  • reapii.info

  • sungkhong.com

  • samakayadtb.com

  • zerofuchs.com

  • taxopark.biz

  • eatinginbangkok.com

  • cooleju.com

  • zensane.net

  • enviraogs.com

  • 1stcentral-email.com

  • zylphyr.com

  • 1zg0xq.info

  • buyercard.net

  • moom-intl.com

  • wcjcfj.com

  • boutiquevivace.com

  • zgluntai.com

  • bkddpec.com

Targets

    • Target
      order_pdf.exe
    • Size 499KB
    • SHA256 ce77e7ab25929572d8a2bf30be4216110ec2235c9859e160ec207dae38f788b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    xxdiscoveryformbookratspywarestealertrojan

    • Family: Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks