Extracted

• • Target

    Purchase Order.bin

  • Size

    1.2MB

  • MD5

    4dd9b0d139a7c9618fa5344e6b1387f8

  • SHA1

    53138f14140eb1c253e7985b8385e3853e5a5ac8

  • SHA256

    73820e9bd81ce740a0a3ec45fe10749a64034aab5efbeb12adec9ebf46c0f2ba

  • SHA512

    754b31faed9881071816f2f6a1cd1ae71cae4c0b0590dc22e44211fc2c33d436e62e0b9ac28881284f1e176bdc8ec414db165776391dfa7ba238baa301465ed3

  • SSDEEP

    24576:tdbfh8PGaONqv3Dp2E4xGREkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMK:vyPGaOgNfREkcMMMMMMMMMMMMMMMMMM+

  Score

  10^/10

  formbookcmddiscoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2