Extracted

• • Target

    Samples.doc

  • Size

    11KB

  • MD5

    bd0fc8c16b9edecf1c96615d618b5d8a

  • SHA1

    1d86cfb479d59aa231dea6c39e4e4be93d2f6ef7

  • SHA256

    7c12c16cc778599d1ab51364a58b918ec66186ae0c001f70802c6fa067512ffd

  • SHA512

    1c91f70b04693dd1d9b9f69bbe0716a013427a9db36a4ee4be94677076b0e3a20a14786ebeb79d917aa07e3f2bbb44341565ab87f9aafccfdf6be1120046644e

  • SSDEEP

    96:gNIN6gD/52yCtUjTn8nEt1g8Y7380ehNQP6X5JkHF1hfA0X4HXGgWMU2rFc5g7Zc:mgh2yjjT8EtW3TA04iWJc5g7pV3PCDZR

  Score

  10^/10

  formbookdmpzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2