Extracted

• • Target
    doc_Aviso de Pago_004901616960005378-pdf24-08-2026.js
  • Size 1.0MB
  • SHA256 cdc25eed9c357d8659f95296917c7a3611350cfc40aecd2acaa2ebf066451033
  • MD5 ccc65a542876b95c5edb75e784bf30f5
  • SHA1 b5e8840ebbc5d29566bcbcbe8fbbf68ecf5f97b3
  • SHA512 ec1e1b6174c084b2ea3046e60f6f6d1575445165033ce27bcfbc72335fa4f33a1dd2aa938d9ae4ae3bb8899fb5b786ff802f29d083fdc4962aaef5243a78cb60
  • SSDEEP 12288:D+BpW4YCXLtHP+HxuBHTXuHC1hUNXxtX+u/XLN+uMrM+2UExaHq8jN8PX+pX9PXL:4
  • TLSH
    T1C0357423D5EA7D64234A1D389448C40C6F61279B0F89F6C5DB8A57846AC0C94D2FFEEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2