Extracted

• • Target
    PRE ALERT DOCUMENTS.exe
  • Size 750KB
  • SHA256 5be7e2a77b35c4a4b902b3d391f6b06f53595e759d322638641977a4a45a4b51
  • MD5 5dbeb2492f8919efcc146e9cac71604d
  • SHA1 2ff498487ce1f08522d9ae4118032ede4c5b6005
  • SHA512 4fd9110eb93d11affb3a519318f3b8c0723c8fda6b717cfb2cb9d39a2b80b8eb217091a45acdcd6c3821addb386846685f1961b0e072f2785de0ed67f2e72510
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooko85aratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2