Extracted

• • Target

    cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe

  • Size

    342KB

  • MD5

    cd0e4cab67b7fd76ef5d6bdcb7f25a21

  • SHA1

    a27ade3067d85e7ed462266b503caed5ef89d3dc

  • SHA256

    c71e8cd3e58eaeab5de7d296fa62fd6fcad415facc687629d71b25bab56550eb

  • SHA512

    c3ae7c68e14ddd2064c926d419ca88531d0344868792b81f8daab42c63aa28a096781fbb0cf38fd367cbf64d94ef073c17d17cef762b5e99bb110ebe00345195

  • SSDEEP

    6144:ZBnbr9ZL8bW6Bg1GzljLDEkYiDifeaOcpTlSxbJ3bzGUAR6ZTu:HfL8bQalnDlRexQxNSlR7

  Score

  10^/10

  formbookf4caratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2