Extracted

• • Target
    DHL shipment tax invoice DHAIR00233210 2022 10 23.exe
  • Size 810KB
  • SHA256 1edc58836efa9d62f0257732fd5729bb5b36df6312aca2f29d12dce0731a0c2b
  • MD5 fd2c7f92b1b29c586456fe4d5907aed5
  • SHA1 cae4231fce13f3ae72b342b236d952b525f92dd1
  • SHA512 83258f6cad68466de0837e671d2f563ecc371643720d9dbadf1359db5caecfdbb2af87ddf47e765f0040f1f4a5c34f51f83f8a8a944c1b3a8dd37af0dba59d1e
  • SSDEEP 12288:xi3znDO3E5GilHfiIBFOr5y911LmWMiUgCPRSjzbxTcqoL:0znDOUci9fXFOr5u1xm2zVTg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2