Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.10783.4606.exe
  • Size 1.2MB
  • SHA256 0422eb91595e9d98d7f4373f91bf00c8da685e1cae1545082807698d9be95b8a
  • MD5 c78e929a5b11f83aa90306f498a4d6a5
  • SHA1 b4f6949742a6ce9e9610df636aafe7743883db64
  • SHA512 dbc972768c6b0ff7cd33bde3ed4f5ab842886c6ada11946213a5a31fc57288263d7b63b192303686374f62b63b78507a13d1245a2af0d7c22b535451e082b7c9
  • SSDEEP 24576:mV1G+MSdbPST5T56ZqOklEEcMJ1aW6lhgWlR/XrOwR7EqdOp24H4444C:mmodrm5TG5mikQoWvOwRgqdOo4H4444C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka4b0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2