Extracted

• • Target

    New_Order_23112200881.exe

  • Size

    1.1MB

  • MD5

    29d854c5c94cc9c0f35b50187fcf9e23

  • SHA1

    fc5b74e5a6e1e4289532c6501ed9b22811528072

  • SHA256

    75b803222917f13da307cd36a22b56e0192860ede2c368cab45d53cef5f4422f

  • SHA512

    ac91de3ed540491307d7bbbf97f578ac42d1d0a17d3f55203f73890c48e1a03df327f45de3a54a4e4a4ba4a8fd524cb5d21d2983f9f28a7d88263e8f6bf98d95

  • SSDEEP

    24576:AzErgh/awe2DzVv99n+oHZIRXs0xWcPhFpyk:AzEkh/dZdv9JzIRXs05Pfpyk

  Score

  10^/10

  formbooksnkyratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2