Extracted

• • Target
    Revised documents.exe
  • Size 741KB
  • SHA256 6f706398207b1fd3a00de5f859dc840cf8e100175fdabe260ebb96db5980f03c
  • MD5 034884d1de2c2e61a49d403a6673118c
  • SHA1 4106f0fe2e8504f0f71cc012ecb992b63cb0792b
  • SHA512 3a751cde89e771defecd23a1fda44c219df59bca611daebd8be29985071e0e5d5f15f983306afc9b468c92e2bbb96c4b6438ae23fbe896927cf47c29c72037b7
  • SSDEEP 12288:2q7kGLFFgETr/iTTbB6xddbQT+wwOXgMSQejYO6YmDDI01jnIltQLZEK:l3rKGHbQlSQ/GmDt1jnRj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2