Extracted

• • Target

    proforma-3289.exe

  • Size

    1.1MB

  • MD5

    ac2c24eeb56a0fc9e89d995c4b0d5c0f

  • SHA1

    cb42fd2596ed3ef2f681de0919fb61293e785974

  • SHA256

    985737716694171ca5cd45760d29ab6aebe57efcd2349bc5085ff13cdd365efd

  • SHA512

    ff3a83e78a3677ca67ae22667c341add857f117c40509dbaa7eac2a1d85649b1eaf6317a440fbab7e86e1eff4e53d27a3564081ff320f6bafc24cdc58dcaa9a4

  • SSDEEP

    24576:0AOcZ2i7g/0jTS8U1L3j5HUSIOg0+MkYG9:i7S9m/5HPnk

  Score

  10^/10

  formbookmr06discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2