Extracted

• • Target

    40dcfb704112265b383679baa3064cd7355bd02119b117f396e1b0283342362c

  • Size

    278KB

  • MD5

    f5bea76ffac05afbe19274595801184e

  • SHA1

    93ef457bfcbc5f0860b1b7f6353ed6e9b0afd60e

  • SHA256

    40dcfb704112265b383679baa3064cd7355bd02119b117f396e1b0283342362c

  • SHA512

    3e1537258907bc3707c5cd0a54b4b5d35516e1ccb2443dfcfb493ecd931a734acf85bf2fb9aede36893b7dd12ee71baac7df48506117aee972bdab68e6a08ab3

  • SSDEEP

    6144:QBn1RomeugRHbNAtHRgt/GVl9tSvOBFRQecwcwHa:gavFRy5Ot/OceFRbfHa

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1