Extracted

• • Target

    4_6048434599929842876.js

  • Size

    9KB

  • MD5

    f0d8c4e88c78cb534e1bf4df33cd0edf

  • SHA1

    56e576823ce200a5d079b245cec26c4e1af71b4b

  • SHA256

    392d3c413e8ea60cd0c8ec8876f0ff381aac710dce9ccb7f0f3432117582ee89

  • SHA512

    25601825fd6b756aa65f84ab3bbf7f9ed3b953ea77d26b36fbeb91979c3d8abd0f655a9ace4f0510073a890c1fada5bd147a71bca6a563aa01c1dd66d1150082

  • SSDEEP

    192:gRwZrQjrWzVD3CxZRfVjl/yzrPKs3RuHLKyJW7X1Kz5uMYICz5uaYzZ46Qz5IaYr:vZQjrWo3/ySa42yYFNaxSr+uai01z7U0

  Score

  10^/10

  formbooka3c0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2