Extracted

• • Target

    ORDER.EXE.exe

  • Size

    275KB

  • MD5

    40c08389f9b3ac964f7a1188f51dfb7b

  • SHA1

    05b6fb387f69441d4107227d361d3b8ffef821dd

  • SHA256

    426072e14b14fa10a6bf93d53c6bc17ab8d6c0871411dfece93bc765fd7d55ef

  • SHA512

    e42e4cee19cfd90c0fee5ca6ee9425cc257524a1c4de02f94a2b01bbb99679c8794c981eec61f743afa0e8afe5bb744299033695f71fede7b6e753f97e17cbf6

  • SSDEEP

    6144:Lkwtd2QvDC3Wol85o0Fv7UbxoNdyY5A0UHpMV1s3CvPqPY551P:bAQvGWouCaUbU+pMQSncY5b

  Score

  10^/10

  formbookscsepersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2