Extracted

• • Target

    docs.exe

  • Size

    723KB

  • MD5

    136dcc6497b13fe87bbad4aa5f859593

  • SHA1

    9da85420d2681d65df6757f44a0c8055ce6c1fba

  • SHA256

    c89c37f0b5dc89251da6c37aa8e1071c43d52c80fd2326f1e6de8dcd5eaf0dfc

  • SHA512

    5e842aa0858845c4322c847fd2497cfe515a2ed62e36337978a020c061d6555cb19dbac58c6c988a97d3bfd88de66bfc4a4e96bf1c46e78d94c2435051cd1c91

  • SSDEEP

    12288:21ZF8Kz3TPb4DryC6L1+0rs/yo05u30HzdHpGo1UV60QFLZSkR:2yeyrUp1o/4HiV60sZh

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2