Extracted

• • Target

    tmp

  • Size

    576KB

  • MD5

    4218b9cf266916690af26776acf29627

  • SHA1

    d69e2af929a0d406d7eea8316e9747db1d4a7ff0

  • SHA256

    dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b

  • SHA512

    fad04a07efa85b91c64022f0b9b1fefdc80a59cd9127e6c1d750f803e2377c71793f20add0532ab2ed595cc9a98a8c9d522c6c42bc6fc07cfdfd2eddf9954d05

  • SSDEEP

    12288:xWO+lpbKbfO7FoxgcSkgyZyfOL5eJxnS4ta5NG3WlViKY:xWnbKzxgcSkgyZeO0TtWN+

  Score

  10^/10

  formbookdcn0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2