Extracted

• • Target
    New Inquiry.exe
  • Size 792KB
  • SHA256 cc8fab47732be49333428c71d3c6dfa04663cb9bb2bc388f0dbb2c303e067150
  • MD5 2303cddd86181ded5023331ecc15ef5a
  • SHA1 5e99544e1a88fc6fb601ca28fccb168f5c53ef9d
  • SHA512 2afff78ca3b566123bf58d5a74786c954a261570c2c35240ca9d08e176c32fb07186cfc00aef612ff0aad2ddde9d2bb2888a610945bec983b281ffd60d47b48e
  • SSDEEP 12288:atvX3E3BtLtcLw6bXQnyiwxc/OyYDtxA/x/qrzlVic8ZBs:atvX3E3BtLtcjxW/lYDw/srzkZB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookr83rratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2