Extracted

• • Target

    9afee5e6dd1d97f008641020ac405b40512c4c8f3ac1a9ee278eb75d18556bd8

  • Size

    242KB

  • MD5

    4a1c5227914a9c9282c5dcd651a0ccbe

  • SHA1

    f4e41cd45bd8786b22dcae6c78c94ec9f2a810a0

  • SHA256

    9afee5e6dd1d97f008641020ac405b40512c4c8f3ac1a9ee278eb75d18556bd8

  • SHA512

    9919d1ce07cefaab0b09b9266f01b4983cc2b7d0e8940f9eac0c6e27c471da0e619238fd15c79925471c9658930e59b118a693809b3c8121918eda39fa1af115

  • SSDEEP

    6144:LkwMj35iWQXLGEp9Wge0p7+ubCCFd5VYaoVAbqpYEe:i34WQbhmge0Tl5VVoibqpYEe

  Score

  10^/10

  formbookhenzdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    anvnzaoum.exe

  • Size

    49KB

  • MD5

    ad7b04bf79722139410e67334277fb3b

  • SHA1

    df89d32ebf661b167032342db2a99d9d71279cf0

  • SHA256

    75f11c547a4b59ce61b7b920bffabe67c0b0fc763b9e85e3db385c8c7207c2bb

  • SHA512

    457e541e5d474441038af606b408af5a70f6bae6f87bbe4ab5d8b5ab753793c72c5ae742647d3c27b17070057319ec435fabe1218acbe49be315def29685610f

  • SSDEEP

    1536:cjjouox7Qn6FqDL4CMY+GsWNMr/5PP+5w:0jos6CL4C2WA4

  Score

  3^/10

  discovery
  behavioral3behavioral4