Extracted

• • Target

    NUEVA ORDEN DE COMPRA.exe

  • Size

    1.0MB

  • MD5

    491066406db17e15ba0856060cad6f53

  • SHA1

    3a2951a74e6becf5d6ce1532542013e56509bb60

  • SHA256

    b1a04015ced59584115a625dd19ee394005f911b108864b0bd834163d9c35181

  • SHA512

    7c3a30eb1d7c0d2dcb188d089fd6325506820e804a6babab5b4723153fd50496cd78022e98ff1d513cd52c57ed561e9d88330462fd9aa60cfaca172912f2a15c

  • SSDEEP

    12288:U+5owG3Z6UiGwas1dxk8ibzwhuJ3zps7FtdfmgHSvyUQ/v2FC/U/X0Mnw2gvJZ:U8Gw7dxkwuJNs7Zfm0SK9HH/U/0rvT

  Score

  10^/10

  formbookde19ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2