Extracted

• • Target
    DHL Factura Electronica Pendiente documento No 04BB25083.exe
  • Size 710KB
  • SHA256 d9e11bf6dbbb2e9e75574f370b57e32efd4be3b1ba193b934933515aed9b933e
  • MD5 57c1720399fe09ae9cb92000d830260a
  • SHA1 5a9eccab9ebf649c94051ab9d2eaea47621ff3d6
  • SHA512 4337ebb17161285beb5cb2a30883768e893331cc36b2380b63da1559ae83bdda56ce2c248ffa282dc83639f39c71425ff26487d772510c28b0d6c515d96db76d
  • SSDEEP 12288:Gsz42MZXW/3NIJhn9kMnv5/mbSegsEZ5U3nYpIetJFwuqQb6BtDX:5xMZG/32HnyMBm+eqZe3YPJhqy6nj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2