Extracted

• • Target

    formbook4.exe

  • Size

    1.0MB

  • MD5

    e434c99075bb1cc365706ac25bc1c53a

  • SHA1

    4cbc665703ef6c5eb46608aa5b8fef42c6afe6f5

  • SHA256

    f50fd444e689593c2b29b62961986f31fe2b61f28850d23680aab7671add1365

  • SHA512

    a6de56271d64f1ec3c4049faaeb99b7822f22b0acb6716a5ac52f7726d6278724d3110361cf13b63d441af01c3668dcde727a3ba322af17e00b33b0b0abb4610

  • SSDEEP

    24576:bpxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss8gPkS3k:23cj+/ZEFdj

  Score

  10^/10

  formbook5pdfratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2