Extracted

• • Target
    Shipment Document BLINV and packing list.jpg.exe
  • Size 367KB
  • SHA256 b29f337a32ff665d1a88419f2ca2ecede9986bf51027a125ff85fea1e54cafb5
  • MD5 35ca8b572bca34d8223238e23dd2897d
  • SHA1 f361b7e717db43ca4a6614c7344b1a67cd4fe9e7
  • SHA512 54e684190e24963b86c502725af64ba857256069e1fa6e29fdb828dba18cd53b07188b0808092f8511d62253064292edec0a92f06f933d40712be23fdec25d75
  • SSDEEP 6144:J6dbOGzzzzzzzzzzzzzzzzzzzzzzzzzzzzkzTzzzzzzQtkauL/sVfEBlUbrQ2In3:Itka2UbrQlZb3jSGZNiRH6U59j+9z6sN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryformbookhn73ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2