Extracted

• • Target

    nicetomeetyoulittleheartsweetheartsheisbeautifulgirl.hta

  • Size

    14KB

  • MD5

    24a0a0feeb3c8ddf4e0a8480107d5a47

  • SHA1

    826364c4e1b951b3cb5d0c5d82db4a8e59e05140

  • SHA256

    56966ff863d37f048e873725f57c3d6ea7883c4c20c033f2bd5f85adeec1b62b

  • SHA512

    2c318b518bf94a264dfc6ae8938a00b7f915a38f7105b4c7df7799fd242b9906e4147644f26b5f2ecdcf892f5186efcd9c5182ef1e8f155b460a24d7ba5cac3e

  • SSDEEP

    48:3aodOOQvMUUdOOQHnMUvMxyhz+rntkpyr+slA6Y8TurdkGijmQdkrC3dOOQe0dO1:qoOMhQM1AhmtscdlRB/arEY/PMfW+

  Score

  10^/10

  defense_evasiondiscoveryexecutionformbookb101ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2