Extracted

• • Target

    Ref8810998235 Auto System Generated Order Form 051022.exe

  • Size

    920KB

  • MD5

    7bf0c2ef33695a76ec7cf8b489cef20d

  • SHA1

    0aaced5986e6dd808ce1128233407d6db7331206

  • SHA256

    832ba5363bd145bbcc01871bf79726fe7d4cfe90d9f93d9cca64598887c91d38

  • SHA512

    31fa2a2a84ea1474b0f1182d1f6ca8b687c29a5246bb58941c86604065e8ed8bb7e49ef41ab84b5f41078fe82f384eb87ead21ee527c0091dd06b79f1ad64cce

  • SSDEEP

    12288:oPCJRz6sid7VycOInfQcbD5+6eAPxB4PWbRdxk4ve:qk6/d7VycpnbI6eWxB68de4ve

  Score

  10^/10

  formbookr83rratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2