Extracted

• • Target

    jetsoff7785645.exe

  • Size

    1.3MB

  • MD5

    e490f6c7cd9da30e00552d99d40a67d5

  • SHA1

    303aa4cecd54421ada7ae26d4e226cdd7272bff7

  • SHA256

    03df164dae575c2017f7e03af8a2fab8635366e6eca3db93501233ed641d022e

  • SHA512

    7094940fa63a295b42d880d1d2badf4f9afad0d95db37f77432124f6d2571f224093603a65e4c81d02ce7cbdf4550b33ab262853e4d259e9d4ec0e26896e341e

  • SSDEEP

    24576:iAOcZXp0NBVQVxjvhGYux6V7xRF2UkjPV99npuezy71oporahu:ohHQVVvhJI43YUkj9fZe6GH

  Score

  10^/10

  formbookje14discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2