Overview

overview

10

Static

static

PO.41022.pdf.exe

windows7-x64

10

PO.41022.pdf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO.41022.pdf.exe
  • Size 1.1MB
  • Sample221004-l43dpsaee2
  • SHA256 714e4e1608cc5486e6ebbb112c3dda90ce2398d346539ef636adb31d5268ee58
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooktz8tratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • tz8t

Decoy

  • NFk7MP6QpDFJEJrVpUy0

  • GEMrXu+Hnm9IKFxy

  • IT8gJF3/gCxP

  • 7dtVECE6S0wDp06OGg==

  • kzuhI3D1M9lFyzWhFA==

  • UVGjAr/aAiVEBPtKKrIHS8c=

  • LUoV7DnQCbhftSNxAa/sb9o=

  • gBXNjrxhyASzXx9kAw==

  • 6o0Vl1R+tXIKX8MLl075wvb+

  • wWleMnYYLapbM/cZKrIHS8c=

  • mxcAPMpdoFgFWMnluG7HiA==

  • Lc8s0dmxDB7HJA==

  • fNexBb7nimQMfDM=

  • /wFu2LTK4fCH1sEQoIB5gwZYMbig

  • 9ZsAf01ejq1YOX+fR9iK7DQUpO65

  • kk66JPP8RtSC3lTXoWfy8W8RpInmvB3fWg==

  • y//p1p2nIgC2Ig==

  • 6csYfkRRU1wPp06OGg==

  • OjvSTCtGd5JAKOFmIMGghg==

  • Cr/W0C7J+w5GXx9kAw==

Targets

    • Target
      PO.41022.pdf.exe
    • Size 1.1MB
    • SHA256 714e4e1608cc5486e6ebbb112c3dda90ce2398d346539ef636adb31d5268ee58
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooktz8tratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks