Extracted

• • Target

    DHLAWB-5024310182_1212.exe

  • Size

    898KB

  • MD5

    1621170620ee606fe369567061032b7d

  • SHA1

    21c39b4591ee3c34475cc56447f32c7b9f55d806

  • SHA256

    314cf1d9477fd2d1c1d46503bc2aa48ad0ca137c31bff40d3c821cf3b4ca3bc4

  • SHA512

    085c355943b47afc508855afc853e46d36e6580d23f1c653b2677b965ff48f76fba4d980cba07342bdd39ffc46b150eb17e38d9ddbebe1938d57c55d72969b9d

  • SSDEEP

    12288:Wcj3JHu4nMiRR4C6slfvHDPli4H/eigJSx0MQjma3gKZ/nXt7virmWhlGLaQYIp:tjJHu4nMq4CBlfPD04kJSx76/

  Score

  10^/10

  formbookd8axratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2