Extracted

• • Target

    Documents.exe

  • Size

    773KB

  • MD5

    fe3365e83f4a43d63e0394450e1e284d

  • SHA1

    f36a3148c6220bb10b0c828cf9818e75676d920f

  • SHA256

    114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea

  • SHA512

    de3a276bfd45430cc926a3362246baf78d5de04fecf234549c6ecc219249556aad7fc9e65cadfc83a14edec9940ea1860fbb758376681bbc0bd33b19ce21b724

  • SSDEEP

    12288:xdZfTbsC8pAhY42pX13LLA2qpDJzn70NsF/qBth53rSdxj:xfLb78qhIF3LLRkzF/qh536xj

  Score

  10^/10

  formbookm82ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2