Extracted

• • Target

    Quotation.exe

  • Size

    704KB

  • MD5

    64d571f6ab61788ccd1d0e7e83f85e1e

  • SHA1

    65c6d2dc29a74b4ae79594c2a0517c41a0798f9c

  • SHA256

    b81deeedf20176eab269dc52fb165d8d8c7f74fe3bddf09089702b37dd012ce6

  • SHA512

    29f813bf6539d76e68955f93ab96b2a8b3174118f05be8a9ec4432e9761ac7694863146e29247cfedd243414fdebd07ebbdb3537e5a729f985bc6ba3686e89a1

  • SSDEEP

    12288:MPFQH49xB8v6CJvt7pxtQdqqEoL9zH95wo3BE:CFQY9EtxtQdBEoL9zb3O

  Score

  10^/10

  formbookce18ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2