Extracted

• • Target
    da72b1c1f701daef602285b17fb03558.exe
  • Size 286KB
  • SHA256 71ed7ee8f0dca2d6d7b8f03f862a3e730c2c48a84bee4cbf3b9bc35b9b0a5719
  • MD5 da72b1c1f701daef602285b17fb03558
  • SHA1 1ab39640c45a223523aea3aade91cb5853077163
  • SHA512 f2e1b2c9a6e40d2d54cc95743a58be98f297620b9df088f64a30b915d8b7aa7bf66f58491f25b7651cc7e92d6ec48437709b6ff69880ccab3746c63d7f77e66b
  • SSDEEP 6144:HNeZmfWTNhVoufbOIJ8SzQpBCsmqeB0+KpagQcAux:HNlkhVXJUZmqeB0Xpagt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookgwk0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2