Extracted

• • Target
    doc015383202_Caja Rural_pdf8125446.js
  • Size 962KB
  • SHA256 7a63470ba5ab9eaa24a93270ea92e14088c096f7bca61f9ef08573ce222064b0
  • MD5 20231db92150111ffd8c5ee7ff896178
  • SHA1 f725eca98afdc9611c9d777657df663c14f891d4
  • SHA512 310eb35cfddcae33925b4259b2430ecb015cc933e01a0b645ab63290e4a1150e86ffe6683f26f13d538de9b1c4b62576c22b92745bf00acf95201e6471d99a9a
  • SSDEEP 384:CXCjqtV7yDz8VykewFx9V4mXDdMyAoQPXA2ZcMHX+sJdcAvmVuj4bHNX4/kApATn:cVgdCcur
  • TLSH
    T19C252D3B700FE2487EF64164D8628958E9BC4567C3052F4AF61D2AEC3A5CF426F7C4A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2