Extracted

• • Target

    textview466732.exe

  • Size

    1.1MB

  • MD5

    3a7e5d1f2647dd5b8db9b826116f4ec6

  • SHA1

    85cdf938d50c68137dd6b344dfa54efb7236f486

  • SHA256

    927d0ba12659ceffb9d3f45ad9eb34bc9f8a9b6931499cf08a2d94be0dbf8019

  • SHA512

    5774393a5960b7fb3f63de19ee07b3c5803dd6164a746382014313121f3ce263be9a5122e38e0a83503d38e7eafa3328c325b7c26276c9e7b7ddad5fb5217d10

  • SSDEEP

    24576:0AOcZ2i7OX8FbAQFred8TPwUcztVqEubl83o9ZkbgWf:ifAgdgPTWfqEUU2Zkt

  Score

  10^/10

  formbookt01wdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2