Extracted

• • Target

    dc4fbd4c5afc724315acba1b784d042c.exe

  • Size

    725KB

  • MD5

    dc4fbd4c5afc724315acba1b784d042c

  • SHA1

    2e1cdca264a4e29571079c2c2a2b36d899812ec8

  • SHA256

    5399fd8bbc8978896233268aa24421cd3d206c606d11bcf64548e8a628be6fc3

  • SHA512

    a2371f0158f41e0bdc651a81e299292f9a73b233074b6ed829d2caab3fedf1ba657a57b890c44b89ed1a0c02f5e38fb14ddd13da6069ed864e1966526bd63c1e

  • SSDEEP

    12288:4i/Pag+5072eFlCk2D3U6xMrDpm6UssNkIhGM/:vF+iquCxnxMrNlU5kq

  Score

  10^/10

  formbookoc5eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2