Extracted

• • Target

    Purchase Order #PO11774.exe

  • Size

    640KB

  • MD5

    e0d5a1d3be5203913a112da74dde9326

  • SHA1

    9a0c4da5adc288a9921d0ef9103ed27da1e0464d

  • SHA256

    a15006eb6ff449cff64e2df7ed41e85051eb25c0e179b14c9e04f7464ff69bb2

  • SHA512

    44ee9fa209cfc9478bf79c97ea0cd1eaaa6e2301c7ee0228850c1136db3da247fa1902559241e0e726ef4e47d05387aee99c4319e1673b8ada500a4c0b8f1593

  • SSDEEP

    12288:0eQiKaxzulQ0BXdLVymkQwF1712Me7g69MQyCjrED:1Qi5uxBXtVlkQw1jv699JoD

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2