Extracted

• • Target
    REQUERIMIENTO DE COTIZACION.exe
  • Size 652KB
  • SHA256 dae7c8ae10158c7be9ae7a115ea9b8fd40b6d3f85cace0cc10feb9ae8d8539a0
  • MD5 86cc523dc15e1863e3afdc66d64262d1
  • SHA1 9d5b31adef80a7c4bfb84b0b07717fb1786a4552
  • SHA512 10217da2a9ed513486b49e82c10524add67a98d9f99a583598802ef52dd7d66e412883fe61787b1e5e4c75c903015319d286d4a31a36667d02fb2bd0c53c191c
  • SSDEEP 12288:9Nd53rD22qXLGzsvYisr3CtK5rb+gh9GDdTzuNwp0CdnVC7nJb:/rDkyIv0rF3pkDJ0m+nJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookgy14ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2