Extracted

• • Target

    payment_copy3_receipt.exe

  • Size

    535KB

  • MD5

    ea670d2f2b5b772c59b790bcc65c59f6

  • SHA1

    e173a6d224a97430b89bd06df5b2a4fb50b17a30

  • SHA256

    f11ff5bb01c4ad6c270b86f63b4209127d3521c98496f6bb2f021c99eaa881ba

  • SHA512

    b4567a35305637dc8380ca04d634cc291722063f89fe9150881314a24f985d4c218e95e9fec343269591db7a458915bd66946822403dcf86c51936121bc3b4bb

  • SSDEEP

    6144:lBnlWGbqJ4rPFzGCMrjCA6YCZzhKpNv9l2Di9jGn5HdDJRwkOMsPPrs/Ja1UV:w84JrkYszhm32CcxddRws6j2J5V

  Score

  10^/10

  formbookveh0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2