Extracted

• • Target
    QUOTATION_DOC_DOCX_PDF.exe
  • Size 96KB
  • SHA256 d4be4226b685156a19f30ba35099d97c9608c08053992fc0d158b8f6b2bb7712
  • MD5 e7e24dc3a53ea2ae2a518ae5d743d100
  • SHA1 840b21eb96719e91e063448d53eee6334c7f656a
  • SHA512 996f910dbb5cb4eabddf60e64f600aba69ef64b7dea3c0bde1b55a8c918399e8e054f238819214f69f69250008cb89d9ce9bc9266188c6468a19709fb205ed54
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratspywaretrojanstealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2