Extracted

• • Target

    payment_copy2_receipt.exe

  • Size

    535KB

  • MD5

    9b8c61ded729ca6c9d5f7fded18eef27

  • SHA1

    37fc137e9aa09fc01820cd90c851ca3aee6be72a

  • SHA256

    c1609447bd7a2ee528d1f2145ebc3ad9a53efee61111824d22f935e497bac31f

  • SHA512

    d2696cf0e8b169763a1ba52211edbbc729f4f3a2aee8b6c029138d0fa180000b1f1781e777edb7328520c057c522371a698279e5ad178fda5b961d127bca27f5

  • SSDEEP

    6144:lBnlWGbqCEADGaF1B1XBx23XB0RQ4MXC+l1O45IDkQBha03YIjo4:wCEQGKy3R0qPHO45FQBhaM

  Score

  10^/10

  formbookveh0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2