Extracted

• • Target

    Inquiry for Sincola Machinery Co.,Ltd.js

  • Size

    9KB

  • MD5

    a68eba24491346cf7c631847bc7cc3f3

  • SHA1

    53fa80c29e51aefdfb28c1613185b9e024970d55

  • SHA256

    a4ab80049941f79e310e791e0f26108f9c5105ebef9731c9942074f395324d75

  • SHA512

    dba9333613f3c10fb0111e766b90c5334fc36ad8faa0d987b83f9be246aa134642d472ba6142a6dec83d62a94610f9f68fed9777825809d000272a2d2b79d54d

  • SSDEEP

    192:g0vh7Qc0FMeu/pHnep/puk7vo4fcf1J08wVLheo4FbLlhssH1UPkOcX9tXZWwcZ4:gadr0yeu/pHnep/puk7g4Ef12VjSLbpD

  Score

  10^/10

  formbooktpd2ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2