Extracted

• • Target

    f709663edaef8f4578cca9fa6de27c39e7748350c4d737182380a041c51dba2e

  • Size

    241KB

  • MD5

    f93308a9428065a3ff3d75c40d64de09

  • SHA1

    d4d42dea5dd2047d5df137c2e5fcb9aed7c58218

  • SHA256

    f709663edaef8f4578cca9fa6de27c39e7748350c4d737182380a041c51dba2e

  • SHA512

    dc38a57fd1dffdf72ee2b5a90006790e7a55f6bca22c08215eb007e582513964dcedbaa8fe3a5676a2cf5d708a429b1bbdd0c00c636cbf27d52e9cccde2890c2

  • SSDEEP

    6144:HNeZmxExGrK6smi9FnGg4gZ6+TzLg0tWtowfvlAv4+OIVR:HNlxEGrVHkGgXkSzLz+owFAvCq

  Score

  10^/10

  formbookr1e3discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    gvwpfsvx.exe

  • Size

    5KB

  • MD5

    7736fb3049e387bf3b1c1a45dab8b94a

  • SHA1

    d6d7bb9087a9900c824fea643e6e84aed3a62cff

  • SHA256

    a53f89fbe86157a1979d0db0748e39d4785666668bb6372156c8724492112ca5

  • SHA512

    5c022f1ada7c8f75f123789a7dae6ae12329641e7cbc7884f1967aa600b89daf2e37eeaef9e0af33c75dd33f424525211de061b6764892b59e7cd5528f91a570

  • SSDEEP

    48:vpgyulOtjX6eA4l/XxT0IG0fkXudnPPMjs7nmQgnmQE++6wDZ6iOFfGqyYmR:BIOtz6eA4l/XKM+o4s++6wDZ6BJ5yVR

  Score

  3^/10

  discovery
  behavioral3behavioral4