Extracted

• • Target
    854f1e97-5dbb-4a87a5PDF.js
  • Size 54KB
  • SHA256 d3b2ccc8a4d957e446ce7d29558c29d9ac9949c24069e08be6d4f43e6dd0748a
  • MD5 106584fa39d3f59161d72551299456f9
  • SHA1 1922a35867eebbf924a981c361244dd6ed2f0a3e
  • SHA512 e626c9a98d377993396f29fff9f43dc69d8c7c0af470a3521ebdbd8911d7456948d3c8d9f9b84f279633ead2a6022996f13a8e1d874d38ca19963ff8a99fc46a
  • SSDEEP 96:TQ56d3BYovlPZ34NqmqaG8+h7ptpdkPRrlrXRxLDAODphP:Bx8qFdmR1V
  • TLSH
    T1BE4321BAEB97C20ED74821C344B4EFE951D2FE6687E5F60E5129D688233C7147D928B0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2