Extracted

• • Target
    DHL_FORM_14102022.PDF.exe
  • Size 172KB
  • SHA256 b22baa52239e6da2ea4b77b8fffaed7b32efdfe6847d6f437c372ce441d00e84
  • MD5 ca425df0bddbff83b3fd8c1cb6ce1507
  • SHA1 3e549656067bf82fd5147e12c9b3d1d221a4f115
  • SHA512 48af71871330c62aefe194b2aa6cdaf2ee5bd1b32e06b79be5a8cf9246ac3efa7470bf5c3716d57ad0863f2a90cdea5545101e2b28166cf6080d72c6d71d7242
  • SSDEEP 384:uS/cHwktWDPYSBfI3p/xdC54Chdj1ak9209mklRoaJ0ceNccPrNcVFVtl6uF4Zj5:uccIShChdJDzoaJKXXf3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookss73persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2