Extracted

• • Target

    Scan AR441 SHEETS.exe

  • Size

    483KB

  • MD5

    ae6e5c25ef61b57b0474c12fb74b9880

  • SHA1

    feb3c0ced829b8ab62d94267f4ec0578ede5e58a

  • SHA256

    31d9c25d965fa6de72c0c376159c19da21bc5dcd579bc038b2134d19b1ca9ab2

  • SHA512

    0fc452ea778b13aa467a4e44e6d98896d319c32e147067fbf48ee86842b672b10cf8e571f9292fef429aea009c899851313c625b333b93edb2607c75853a2bcb

  • SSDEEP

    12288:Wtm2gHDUkrFwT3OSwmucvWwfmRbBT3lhQvaMmgG9l:6gIIFwT3OcucUNwas

  Score

  10^/10

  formbookpfgcratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2