Extracted

• • Target
    108722FTTOO17_Advance TT.exe
  • Size 225KB
  • SHA256 2b3d32ba155e67989eb11a9cf80ca81dc5ebccd90e1589996cbeb613d445874c
  • MD5 35c80a1656228ab11b5ea483dc7b5b20
  • SHA1 b4e46cf73a2cb91ca01a0b534749e14cfea12f27
  • SHA512 4fbf15c926e718ef22f5c736d042a0459ca9e75b2a3fd2c1ca268595465fb8c068177c2f98a01c2c4ad76c1e3c1a965626d834389ea77af3cdcb8709a2365b36
  • SSDEEP 6144:qweEpLSWkNHG9sRXzoeHvqwf6CoOVj2JWJD:bVwH2Azhdf6+2OD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookaxe3ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2