Extracted

• • Target
    New Purchase Order.exe
  • Size 832KB
  • SHA256 d08bd114dd8a6575cd15bfad46b2216cc25c8fa8f6e46c7d0b4c4cb2fa27b47b
  • MD5 a4f2129dd334274ed78955365d8faa0f
  • SHA1 2d21c5944133053b31542f999a426012009b699b
  • SHA512 cfbcac7fabe057f0842341065993c4eeea6ee79e8bc4000efceeca9cbef6063e3c1995803a08ca0a8406b06fe4f2e16abca86d1b985dbdb6daaa51d17454877b
  • SSDEEP 24576:f6r1qaHMtYAfpUS55CQZH4FBdqV+qDmtUlta:yrgQ2UM5CQZH2Bdpa1lta
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooksq02ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2