Extracted

• • Target
    Scannedfile.exe
  • Size 350KB
  • SHA256 e15ba8be78ecdfc804dba4fbce9e14eaef0d84ec4c9b82d5d8b109c64a566266
  • MD5 56390adecfa92125980762fc0e8494a7
  • SHA1 d3c4dde030bcfc33c66e3a4753da01ccab190395
  • SHA512 7c45d53f6e6d09aa227b51a52cf09be6e2cf1ad1ab0e5aef1eddbe321748dc1d1601a215952aa983f18774a0960c567a2118271a897869565c7d7f36a36ee45c
  • SSDEEP 6144:vYa6Gwv4JbsquWe3Jf+vNUY88npcc90c72Z5X2uWRN:vYowvh02L8pJ0cP7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdcn0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2