Extracted

• • Target

    Invoice NO 22073895.exe

  • Size

    486KB

  • MD5

    85cd688a9fee95b88b94b6879039201f

  • SHA1

    0843488b993fd26651cff415ac5a43c593defa25

  • SHA256

    4d3261b30e45d9577916b421a9b829836e955a9be539866aa29d21aad01283c1

  • SHA512

    9ed65a00f4e6c276b18778feac6140759ebbc159d15c4c20280ff13b1887c73ec4fc88a38abe0f8e0d75ec0e5a5acf82478472b761247bee1357d130bf80ab45

  • SSDEEP

    12288:AYn68Ex+E5Z8kJqeKPMwwOfGo5KNfhtDuCytMi4zaaKL:AYn6DAEgIqecuo5KbsCy6igbG

  Score

  10^/10

  formbookxloaderpoubdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    pvwuec.exe

  • Size

    84KB

  • MD5

    e87c6c672ec024582ffb00811abf747e

  • SHA1

    05921c941ed33b6e0e4cd35c20a452d0659d04dd

  • SHA256

    17a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86

  • SHA512

    5d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5

  • SSDEEP

    1536:gv/Fb08hIFKD8jt+X5tNYgpWtEaXkNGw4vUODaB9cTryEDuubmfs7jzH:q08hqKiARlpWtEaXkNGBUODs+yEDXFjj

  Score

  3^/10

  discovery
  behavioral3behavioral4