Extracted

• • Target
    PO#5099655_PDF.exe
  • Size 622KB
  • SHA256 d606ad2f22a8def869afd7e352766c880404a40948ac435d62d136ea7d61efcc
  • MD5 8064e37c00d515ab176fdfd48b40bde5
  • SHA1 620be0d274ef45cc17cbef8623a8d3516c9983eb
  • SHA512 251332583f69eed85b3b28ed26b68c39ce018b822e9f27419b8c2991c3d62403105f5769e269373e55a3215cb52201255296d64fdac247cba3ab8952ad36791f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2