Extracted

• • Target

    QUOTATION REQUEST 27-03.exe

  • Size

    696KB

  • MD5

    fed1cdaddb684b6463f6642572d2d713

  • SHA1

    0a174c3386b5a37730fe291c3ae333ebdda7d2e1

  • SHA256

    efc8dba0e301b455b4691c60bf363ce60bc0b44921a2018ce2c1a684df8d26b9

  • SHA512

    5ef0f158a93fca0685b41eccce2bb40570d74fb82c36e88bc8b11832d360417af855e79caccfab808d5c0c76e8f40f34367e8aa8e50f8846f37c0455a5aaf7f6

  • SSDEEP

    12288:tN89fTedLZaxIkApSkXYZ0oVjA9T6BBYvkViOmvRSNI8piNnD9aefD:b89fsLKA0kR5zvkVlmvQNIfMer

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2