Extracted

• • Target

    DOC21AZ068G2022.exe

  • Size

    258KB

  • MD5

    868608b7e90e467edba786effe32dfea

  • SHA1

    6de62b0cd19ddaad25b80ced29d35d80410d1ca4

  • SHA256

    5644b2a6b24189d3ffd6e90413150e01dc160e33a062e158f0ef50e0bd02e310

  • SHA512

    c5e76faaafb27d519933f50c3d3961943c29fe3c7e59b125a5fd08eec7f6acdcfbc4071661dae1d2b63216b9a417f2fdc9c674ac03a20ba05a17a1b4e5f34100

  • SSDEEP

    6144:mbE/HUbk4BzCq3T0yLj6tV/SnSUp36J6fPy0nqFm:mb/xPz/nN188lnqc

  Score

  10^/10

  formbookaxe3ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2