Extracted

• • Target

    invoice.exe

  • Size

    753KB

  • MD5

    4de9d309e114114fa821c9b7bb72d0d4

  • SHA1

    010b0e52bf6fc756f22b04c6dea24b0db9b31ff3

  • SHA256

    ece8d55b66fdd470a1037290b30a2e6e66d0ff38fa366ec37a2b0a330364093e

  • SHA512

    a8e52c3815237474e7832e4478e14aeb386cd1c18e05938b580958e8814b3a0f62967927cb260f386e25473c4ebd4fdc999cf04a6dee123eff139b855428263d

  • SSDEEP

    12288:336M4DvcLt3zO0JSeo2113s9tr4CNNF06+DkJV5c+uh09HgCTrHBz:6M4qqapo213s5NNFu4JV52KH/r

  Score

  10^/10

  formbookm82ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2