Extracted

• • Target
    rInvitacionacotizarNP-24070-TB20240304.exe
  • Size 600KB
  • SHA256 6e93f4e8dd9714aa4e10a87314201f18dedfff7f7bc2cf9f8eadb5a603cadd7d
  • MD5 b18fe1b57c7b2757db798eaf4bf19f17
  • SHA1 f4d76691f62779d2879af481cfe6ee056c58a94a
  • SHA512 6b087e2bf05ba93a902a3b7c33797362025ee5c56a3b05f564ed28ac473cddbc3652018531f4fb49ee8db1fed30400393e6731d32479b0d17c811adc3ac79177
  • SSDEEP 12288:4aLGDcAbdcju29Nb+fCnHpD3uHYuAV2tUaMos5KSqRxRVqZV:4aKDcFV7nJD3uHYb0txSqPHqZV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2