Extracted

• • Target

    Purchase order _SIP008.exe

  • Size

    1.2MB

  • MD5

    0f23b3dede5773a4da6e3f6869da28ad

  • SHA1

    16b4fc729dc5b66381e710717acd7a226f0c631f

  • SHA256

    3f4e8eda03283329f391e111c756f7b6ece4a9bc0d41672af8c1f09baf2b1cec

  • SHA512

    5acc67f5cf49dcd7b50c5ef14cffa2990edc146f41ec5507f6d79476fa21026f3a5082b0f8d412153b4951e7f3f1172858705e0d7c582da79cffe88b37402f52

  • SSDEEP

    24576:iAOcZXp03RQgAgCkLOMhc2e+Q+3mG2k1ny76RPGQFV0aBTjWFqwA5:ojRAgCk3clDmtGQFV9jWG

  Score

  10^/10

  formbookmh76discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2