Extracted

• • Target

    DRAFT.exe

  • Size

    859KB

  • MD5

    eeef1bb50b50ea56de000b58d5d1af23

  • SHA1

    913f174bbe99536c02b13b814aece6618dd44d88

  • SHA256

    c8e6840e3aa32b2f68c912e0cd09d6956863418a7bb5cd552dc2fde563d53327

  • SHA512

    4845b3e98c4ab85ec65da6219464057bcd6fc3bfa0ae3f460c81c9d5bf93586f118deb433369779a3782deea9a34406830d2a7932e120b54087228ee4bf7f4bd

  • SSDEEP

    12288:32wnbnku/zUCyxjiurvwqFrl/FeYnjSScwGlW0b:3JnTkyy2urJFJ3jJ7g

  Score

  10^/10

  formbookd6izratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2