Extracted

• • Target

    HEC Batangas Integrated LNG and Power Project DocumentationsType a message.exe

  • Size

    1.6MB

  • MD5

    a03c2d4c4885db5f3e8264e2e0523ee9

  • SHA1

    53d45a80e79d121ec6745cf8816acb7e6598b897

  • SHA256

    9dbaa66ef9f31c83ab943932bc96eaf2d6e9c1995b427c75e6e9a259f2c91697

  • SHA512

    6f2ec109bf1e5b96f35d2b8ff1cc8facad31f329adad3486198f5b80ba38e7a17bf6a10d355f770f4b05b16dc1fedacf43afeaecabdfc8d34b8e998e14135433

  • SSDEEP

    24576:xlUjX00wR9Uqk8qW0gmRR1Gbp0PjcET+v3JR945EIy8o:xKjXMR9UN8lYGbp0P4E6v3Jf4

  Score

  10^/10

  formbookrzndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2