Extracted

• • Target

    FSO31092.EXE

  • Size

    511KB

  • MD5

    a35b2b622c8cf61de54ad8273aca8d12

  • SHA1

    3d7ab379db1ebb329c96f1b7f9aafd3f23172f20

  • SHA256

    03dad90bfcdbb7273d9ec8970c3c3467600822b8244dab5cb8dbb2b2c5f389e6

  • SHA512

    2cccef663cce06d8b5e304c76af40bd45c81c34354aba9a96d7b55c7cf96fbed32eafb207176b91c8bd1b3929a5015e7ea9211e06acaa7e449f71fc5b542cdda

  • SSDEEP

    12288:UBl33Hu46VjIJkzn7tHTN6UWMWttsvWDbE07kyLL1XXMQ+/:u33Hutt7tHVzWttwCoyLJnM

  Score

  10^/10

  formbookk056ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2