Extracted

• • Target
    FYNSOL PLUS GHANA LIMITED-pdf-.exe
  • Size 1.0MB
  • SHA256 60e030997c5371909ff1cff1f037b7131c4a21ccc56d0e28cb0a561befc8b0c7
  • MD5 49ec55c7ec7c7331c75722675b22b461
  • SHA1 eff02dc87410b0ba27d3d01ea6fbf7ede3afe322
  • SHA512 fde36b940b3a9b904f5c6d121bc4fc5ca30698e587fdb41016635659c06897dee061878f2156d31754322a37bc759f72c603b426f0ba1b0e1f559ce3779e78d2
  • SSDEEP 12288:x6Eju+XWqs1dxk8i0whuJgzps7yu1NZCJVrZVGKqSv1Ho:MLdxkruJIs7ypJV9VxqSy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka20eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2