Extracted

• • Target

    New Order.exe

  • Size

    930KB

  • MD5

    72428a6ac37aef0e13873a0073d9c8ef

  • SHA1

    3532378eefb34413d60e6d891e74ea4c26a82cab

  • SHA256

    d4aeb9c4ddc4e76367bf99592f6f922336e21345833c44093deea1248a5fe844

  • SHA512

    fc28fd26bccfea2290d3290575f0f49798abd2bb77a15b7af9817c1f929409847b9ee33f6e6229c39c1267d597d03c5f45824456e6edc05b481e1830ee0df5ac

  • SSDEEP

    12288:i3csGI/cHv3QZJTpiHj3GqVP27dPPPIpFF1s+1gUth+qz5IZvmc4FTlhCKCMvd2U:i83QZJoD3GYgdfQhR5IZvkXnF

  Score

  10^/10

  formbookodsediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2