Extracted

Extracted

• • Target

    ac460b302c16f19eeec5b41c280b9cf10dbbf3f482f507db645533e3d0770cd2.xll

  • Size

    1.1MB

  • MD5

    ac661f69d93e92d2e273093a354c4278

  • SHA1

    1815742d1bcea898864642844d273a7df1e82ec0

  • SHA256

    ac460b302c16f19eeec5b41c280b9cf10dbbf3f482f507db645533e3d0770cd2

  • SHA512

    a421c81251cbc44a387eecde547b6987b5e677471ac78d1622379820aa9b67e47309a29272eddf88a645d1468c50a41ffe4274d888466f97cf067970678abf11

  • SSDEEP

    24576:Fz7GHAzH7jX1mFxOf/yixzM8dTOzkrIcftfhGKc:FzCHIIFxOHyixgKOzkff

  Score

  10^/10

  discoveryformbookqcr9ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2