Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.16696.22525.exe
  • Size 830KB
  • SHA256 0ce95ed2a26eb4e5f38cd27cbcac2065b3e6a71a26cdc24f56946dd0428f88be
  • MD5 117d8fe530f41f5eb068b27480377234
  • SHA1 c61eb8e55dbaa0aaacddec463b39d6ef00cc3566
  • SHA512 41a273e191f66b22cc3b86115b867df8fdf2721c5d5ffa3c4ec73f1bf91c5eb575ffecbf0ddd6fa5de817b4d63eb7f788a49e284780e04f14b8788b02486625f
  • SSDEEP 12288:Bc6sfZ344iymiLkOPQJzCcAipT+oXuKDz7AWPz5jjmahgKZ/nXt7virmWhlGLaQ1:S6sfe4iymiNPm2cepKDz7vPl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookf9r5ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2