Extracted

• • Target

    SWIFT SKM_4_5767189090436911808.js.exe

  • Size

    946KB

  • MD5

    d40709798e6695b0f5cbe45e73dfd677

  • SHA1

    cc27ce3d9199b1ab3dbfa6fea943ea5fc1f4d7d6

  • SHA256

    cc306bb2d4ff7a9b6a4526abfe0ee05610bc1f34f8c4b96f465c44412558516f

  • SHA512

    92ebaee7aa16797cf4fdbed3a25d736610ff01d5a6208aa4463973f7596dc7129363b36b67f82b81f86a0212e248984c58200878030440e576fc0b5724efa625

  • SSDEEP

    12288:D2OfFiAGPtdUAXpY+ZmBjHUk+qNng/lxupZMbDF1Uh76xksye1wHe7YnK3o37YU7:yEiPl95hZmBHklxVF1UrsyuwGj0

  Score

  10^/10

  formbooka19iratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2