Extracted

• • Target

    FedEx Docs.exe

  • Size

    229KB

  • MD5

    c568864dc1f921c09ecef26318d2ec76

  • SHA1

    c975900a226269d980d8d5bcd989ad44ba0dc667

  • SHA256

    3f00dc9a046489c35c6dbcfcf2d91dfe03f7f700574be6a87fa623381727f92a

  • SHA512

    ba132e4637f3b9ee36762c21b374dccd522f18b6fc9660d7af343ff6f622ad83ce0c84cb85ec99aab38889f1d8f1ecf9bb8bd5bf712586c51334e6ce2116b032

  • SSDEEP

    6144:MEa0N3GbdvIo4BrW1/eUFnhe8FtvqR9lWdz:X3QvIo4U86e83yrWx

  Score

  10^/10

  formbookfqsuratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2