Extracted

• • Target

    Purchase Order No. 4502717956.exe

  • Size

    659KB

  • MD5

    56478f00ad85f32b299aa3450f761901

  • SHA1

    8bea35f5c67818749cbcf9a367735fea13c32894

  • SHA256

    77a99df0938f000db363d3f123fed3a7e6c6b9ebce4f9f59d68a277327d15eb4

  • SHA512

    39e02f1355b953926683509b64c889554e390716c170d735837b53299d4afb3654e5e7a1890bd43cd259d7d06fb15b529ffc5380a8cce121f69c45853e7ef177

  • SSDEEP

    12288:H7EIZxD7RP51oQP/ZcrHrEr3MyLWETdDGw3zH+fvmWxsZPbLj:H7ElQP/ZioLWadDGwafvmGcbL

  Score

  10^/10

  formbooksnkyratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2