Extracted

• • Target

    textview355624.exe

  • Size

    1.3MB

  • MD5

    a482429d1a13c6d0f3a879a6673391c5

  • SHA1

    17c069f52138457ea210670b831cf21c89c1f0af

  • SHA256

    39ef261dd5ada5c7b29412ca0e95e6950de77ac8ab9f6e096692fd553a6e3ace

  • SHA512

    ff54cc0abee1d9daeabe9de77ac3e704a0fb7944f4c0644664d10ac7cd813afba9b07c104e5943b4e1200a6b98ceadff90a473e4ff80cb7043adc25239c9bf70

  • SSDEEP

    24576:rAOcZ8h2ftK23S4LMhWNUkjPV99npuezy71oporahO:tsCkNUkj9fZe6GJ

  Score

  10^/10

  formbookt01wdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2