Extracted

• • Target

    Invoice & Packing list For Sea Shipment.exe

  • Size

    660KB

  • MD5

    0dd55fefa69cfb836b9d03765d943726

  • SHA1

    a2825325c6aae44ec72a916d99ec101a4d2acc75

  • SHA256

    d37c856c37f289af0a5cf37c5e2c9ab7b115d401d945426faadc6b48234dc2ba

  • SHA512

    0100ec850eb8e96ff38924761c2c398b336bb08532875e836f825c9fd943886eb886f62ad862cc641bbc95341770d05ab55d008e6664bf4aa24d752e3b52f92f

  • SSDEEP

    12288:962iNczJ+Wnqn++Tm1rhO3lI5yX4dDj1uhpHXC1NogyLhZUNhfsFiyeo:g1qzMtqAejAXACShkFiE

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2