Extracted

• • Target

    tmp

  • Size

    687KB

  • MD5

    e4e38d68339daa4e300e18e34d8191b0

  • SHA1

    5ceb0357310bd7ec48f31ebb8fffb304ff0f465a

  • SHA256

    51b2d72cc4067375ab54571626bc15241676d0207a2cd21ff79c0e0060397ac5

  • SHA512

    76b50c9f00aa673d5b5ffee1528a5df07a7c487b676fef7d31e2eaae0a0657d167e104bef45ba0d915bf578642e9c95dc96f98d3491a035df9ff3c1c7d34ed1a

  • SSDEEP

    12288:IDOHTHVVVcyTyRXTQEalyY24v6Q2bRJfUjcgFOwxpAmkjt6kx:Iej1U0VL2u6Q2VJcjOwxC3jt6kx

  Score

  10^/10

  formbooknogsratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2