Extracted

• • Target

    DHLExpressShippingConfirmation Documentis--787490DER.exe

  • Size

    1.7MB

  • MD5

    d55da7b53f6783640242d92a3f791a3e

  • SHA1

    8a9da2c31da5dd37427497ccff63370b4bca580f

  • SHA256

    33b5dd91de8cc8374fd126d232fa1e466aab16ed580a655ff972c34a226d71ae

  • SHA512

    73bb9755c1dfa1ac64846b37aed1a55879d57516fd8ffd5a196b8bdc2405e402b8511b4ec283c0cfcbb1a84b003affe0047909c5036b9d4138ba954f2018d244

  • SSDEEP

    24576:hJNUbsGNNYY4EiBJyHN/nvYCw3LY7CEBbJ0P1WseRHIEBuyVtjvAjQ77ewJtf:8JaKzWP1sHxE

  Score

  10^/10

  formbookcg64persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2