Extracted

• • Target

    Product Specification.exe

  • Size

    281KB

  • MD5

    49b374a64015666e9ae51070c7df038e

  • SHA1

    5cc61425c317ff5256811adc6ecd9e224ee7c3d4

  • SHA256

    2d0bf404b71b81df2a8256b7adb927dfac1ed504c968f0c7e07dd3fea4213bb1

  • SHA512

    c437cead3a461959791ff0fff852f3e5df34294af52a427fe0c2e81391a97f5fd25e97f0bddae292230775f49b1dd39cb4f1a873c876cb0f13aeb3a15e8f171d

  • SSDEEP

    6144:MEa0NTHageXNHhxZt6EMw+XYWFGuZqdcKI+cCzSLXRt:XTHa9NPZt7Mw+oWF/GoLCzYXX

  Score

  10^/10

  formbookxhnqratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2