Extracted

• • Target

    INVOICE.exe

  • Size

    725KB

  • MD5

    1939130a95b16662cea59b8812f9c505

  • SHA1

    f4103a530615a7c5ae8e712dad07f750ceba9b9a

  • SHA256

    320dab87aef07c03720923504dd0506f7d3e67de57b0067ebf0694966982db89

  • SHA512

    ed6bf56ba3d0883a50641c7f62146b0becd20bf0fefef342ff7afde7855019fe922ced2fd256e6d49eed33095b6b3be02aa524b621fdda203452d69e26b0ae79

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2