Extracted

• • Target

    Official Purchase Order 121322.exe

  • Size

    1019KB

  • MD5

    9e40b98924b94ea375faf0bccf2609ee

  • SHA1

    bbb2330799adfffd534505aac9ac112e16f7fc8e

  • SHA256

    4b4faaccc4842d408c3caad47e364f69dad51765ab242e4dc8c97de0cd190ddc

  • SHA512

    c2a3f6653962664b1d830edee1c84ac9a62e1d908b647c6f88f1b21837c3316177c445ea2af17c0326e79d9bf3b5d4b266fbbb3a87b2eb12ffa1cc972a23b9db

  • SSDEEP

    24576:wGTgVIYba1JXh+Q/Fkq1SW0vQ2lBS4G3r5/oOi3bJhxVsWy:wGT6Iz3RJtkqh0vQ2

  Score

  10^/10

  formbooksnkyratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2