Extracted

• • Target
    ac32cc059f2945493d3c4b33fffd583f.exe
  • Size 377KB
  • SHA256 d7c2f69689d1a1e95671fefa4ee708f62d29f078443bb31259ce2100bf5c37f5
  • MD5 ac32cc059f2945493d3c4b33fffd583f
  • SHA1 fd8557882fe16402378b4c35c92265f7d765640e
  • SHA512 7e38d2401110251975c519cf5573a9955ae4b7df629653cac8e72753ff370c0f4dbec69941fb5b38f0f3f50b768b7474343964021286e775dff00faeaae30a86
  • SSDEEP 6144:MEa0NSc0uW744Db5XPmUeMDxMDUPRLQ7qMw9w354kCzXy0T7lR8Fw5DjVgK6sxN6:XcuW74KbBmXe1QP3qNX7HDjRVuP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2