Extracted

• • Target

    tmp

  • Size

    547KB

  • MD5

    0b839e22f9277f4b0781578197972509

  • SHA1

    f2fe6205fd3642acd8a7ac87cdb3509959cbf16a

  • SHA256

    cc268916fb77287ae7258a4301c427751c9a0277786d101aa74a761419564f28

  • SHA512

    7d0ceb71d54b4d8a01366987d17399e28d5f071bdf8bd58ccc4013a2fbe126c7567692608373c8f7eb53c5c86e19e328ec1bd4e4cfb1a86c8d85a713fd11143c

  • SSDEEP

    12288:2xDqh7zKuImX1RWjosbfrjQajiqIjU4t3:2eKuHFmbjcahIj

  Score

  10^/10

  formbookncprratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2