Extracted

• • Target

    SecuriteInfo.com.Heur.MSIL.Bladabindi.1.3458.18067.exe

  • Size

    820KB

  • MD5

    5497af6f553312b23c217ac67fb68f75

  • SHA1

    6577a07e5f4f7d61781bf8e5d36048d0d83c2e16

  • SHA256

    341a04c9291e3c8abdf73234d07209be2d0a7a26bbf156e1c768eb0fa927cb89

  • SHA512

    a0b0c60ef3ef138d79b32bf7e70b8ddd15b86cfa55dd2a90dfd108424f6bc1629433885dda4f02efb4e98e385753554bd8731a69b392ab90a7e180253d62bfb6

  • SSDEEP

    12288:omyJYTpBMlzqvrzuBBQ0505r0L3lSVVdvmJn1s+GJb6Q0T4HBUJ1vU8:ryJYwYiBQ05uAL3lSXd6BGJbc37

  Score

  10^/10

  formbookguneratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2