Extracted

• • Target

    Purchase order 781830171.exe

  • Size

    602KB

  • MD5

    94a7ae060dd2244f3e523ef87ac573d5

  • SHA1

    6da1cf7a0e4a708e6c986a810cbe87ac73bbf5e1

  • SHA256

    0d65bd3f562fa127be5f009203fed5b0da090648f61d10d03ded5c89228e3766

  • SHA512

    b079719fc7064d9137b53e078e331a19cf0805fec42a68e2c625af3eea95f0cd6aca84bbf75c46892fe03d35d0b186bd118a3821b77a748eadb663e1e2232f5b

  • SSDEEP

    12288:zsBbFXMFRCMxYTri4ZzEouFxSdBTM09Zq8SblZuuNwApnkGngLr8z6:4jXMbhmT24yoW07q88lZuEnrngLrr

  Score

  10^/10

  persistenceformbookyurmratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2