Extracted

• • Target
    Invoice and packing list.exe
  • Size 836KB
  • SHA256 bcfeb4ec31e731899a0ddd0a608aa7ecbfbdbf37f4ac3810b275ba6905a1969b
  • MD5 735a274389af85c4b4f6ccd684b1b30a
  • SHA1 2ae6619febb0c9f4d318daa9f28172c2ed9ed4da
  • SHA512 959bd09b752128ae08262bc7803b857099e3727f025f380a918f5b46ac64384180224ef40cc086c795f54dbb8621798b3ba95362805bccbc634800fc626bf14a
  • SSDEEP 24576:C8yNK1t4NK1tOqLB94uH/Stkd3uRStXvfFQ:Rhz9fvj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2