Extracted

• • Target

    80460-Contract Ref 2023.exe

  • Size

    814KB

  • MD5

    030de17769357418013f18e0ad1b61bb

  • SHA1

    3bfd9fd82f846a73f319eb2a29f246dbf143e721

  • SHA256

    34c2526748f1214c70cbefa7e45e067e86e78c79759cafa9fdf1082795ed92bb

  • SHA512

    84f378d657e3bf30028fe4aeafea91d3da68dfe77531a10d0919dc439285633bf97914b8ec9a9f9e998c6ef3239697f43dd0e1979623017875e4906246445826

  • SSDEEP

    12288:qA53B0OKIZt8JDol8JSfyjaGClHNfUFL1FCgUoygyKIwp6DoFxVf6lzZGJhZ:qA5x8IE9olWK7G6t4jFBJIw4cMhZgD

  Score

  10^/10

  formbookbpnwratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2