Extracted

• • Target

    DHL AWB-5024310182_061222.exe

  • Size

    788KB

  • MD5

    4bc8ce54beb8016d78f09425034b3d03

  • SHA1

    8a3f23548ac66a45a5fba76561757df9bb301c8b

  • SHA256

    ec4741cb3671f0c7563788e27e03fd2cfae2b7470108cbf9e1603b138d034a11

  • SHA512

    2f24cb9e3246826dd851723de0ecfcc561621c8ebe0111d509e1d42fa69967b49ad9f288d2e172a7b56744368d91344da0cacfc7bdfd8b568e20da56c94d6711

  • SSDEEP

    24576:momxiPQFQNWbvquj44kgP6Y/mXYGAsjl:moKmQSNWbvn4hs/y

  Score

  10^/10

  formbookd8axratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2