Extracted

• • Target

    PaymentCopy121922.exe

  • Size

    733KB

  • MD5

    05271d119938959aad2d32404ef0d9cf

  • SHA1

    1409bf13515044a066e694493182b7405ea6efaa

  • SHA256

    6ff54e94c6557ae213d67159c8c8bbdc84079801ba263631f9c7a798f660eaad

  • SHA512

    e313a4313611c66104563cc3dde78dd9869a5b5070082b3d859bdb96b493fdc2fdbab4014baa3ecc7196b3d44c6842f2f1f5b943e119ac316872bbaed911ec15

  • SSDEEP

    12288:5xx2cHss/S+PsN2/fFac/uL9eEhkAEZC4Gf3acHVNc42xtAq:rx2cHs6SqHdaOuBEZC4u37Vm42nAq

  Score

  10^/10

  formbooksnkyratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2