Extracted

• • Target

    ungziped_file

  • Size

    224KB

  • MD5

    c7eac5a7087af67171d5515c27d6f927

  • SHA1

    3e036ca39fab2b5e47aa297b5951954ac45dc6f6

  • SHA256

    0e00f12317743737906e4779e5a936985e8ee76a8254a7ef81f67a5509e9f524

  • SHA512

    cd8f759a09101917d053cbcf3a2269709711e959ac7c655813b8d288da6a507fedd42b06f9fc5a7e17298607543317ccf3fde2754ac7c0120d3513558ac071d5

  • SSDEEP

    6144:qweEpSKY3hdH6CVjlmaEJlnXEGkCnFSN6xZkfpNvpJ:bSN6mlFm0GkiCSChNj

  Score

  10^/10

  formbook0ntaratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2