Extracted

• • Target
    SHIPPING INSTRUCTION DOCUMENTS.exe
  • Size 706KB
  • SHA256 e30fc87ce3075c2d3cb6abfb9a3f1be26d8285b3aab8143787e0dcf976508af4
  • MD5 55c95ec76d0e82a88789859d2a7ace01
  • SHA1 bb9b27416b30bddf133203e748acf58679c76dda
  • SHA512 73bfd72c2f7bfbb3339f7abf2911be7afdad11127500563d86e7d06d3e2255f9414a353ee47b4872537f3fdb1a199ed97c96802432b50c213c5d292c87fa0af4
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooko85aratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2