Extracted

• • Target

    quotation request.exe

  • Size

    843KB

  • MD5

    cd3cfa9918a2e273a9a7b0118955c4b3

  • SHA1

    289bbc79ffbf9717e7bf44cf83f3dd60d8a8e7f0

  • SHA256

    c73fabb2bf415973d0ed742e40260e327512da087231a6528714cdd15ac2205a

  • SHA512

    9f2a05c20eaf02378e0a4bf3b8ca3ab7cb3151b25efad52c52497a66569c3b7460f71ca7f924d3216e2f042ce72ea2ff5a6ae2a875d54948626c672fee8a5e11

  • SSDEEP

    12288:aAoRYHHtJPrc8BLcoraBIx2aHqX2SsHhEzBCs1Omijoo01:aANHHtpBtcQaSxhW2buz/Cjon

  Score

  10^/10

  discoveryformbookktmyratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2