Extracted

• • Target

    NEW_ORDER_00041221.EXE.exe

  • Size

    6KB

  • MD5

    78715a3a620e1f4b1937a1bd7e764e57

  • SHA1

    0b67de4eaccbfe16d41bedc538b2a64bffaecbb0

  • SHA256

    37ad2a3bfe4e60fb4ad6f9edf3bd25602ebdbacf2ce429e96c3ec7b4213090e2

  • SHA512

    b55a095194d506bd111fe9d93440ee97be0f9418256e839ee3ce892af1206711402c493bdbeca021d4187433c0f080febfa44451e03737c3ddf6f0b6c9ccd91a

  • SSDEEP

    96:x+UKECqBC+bbhb4Lp5zV6ur8y2LnfoYYMxaDzNt:xgwHhcLp1V6ur+LfoYY5F

  Score

  10^/10

  formbookgskipersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2