Extracted

• • Target
    Invoice & Packing list For Sea Shipment.exe
  • Size 660KB
  • SHA256 d37c856c37f289af0a5cf37c5e2c9ab7b115d401d945426faadc6b48234dc2ba
  • MD5 0dd55fefa69cfb836b9d03765d943726
  • SHA1 a2825325c6aae44ec72a916d99ec101a4d2acc75
  • SHA512 0100ec850eb8e96ff38924761c2c398b336bb08532875e836f825c9fd943886eb886f62ad862cc641bbc95341770d05ab55d008e6664bf4aa24d752e3b52f92f
  • SSDEEP 12288:962iNczJ+Wnqn++Tm1rhO3lI5yX4dDj1uhpHXC1NogyLhZUNhfsFiyeo:g1qzMtqAejAXACShkFiE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2