Extracted

• • Target
    NEW PRODUCT RFQ SPECIFICATION.exe
  • Size 536KB
  • SHA256 c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
  • MD5 1dd3b84ca099a91b88bce684577e7b78
  • SHA1 4a9065100aee88d00f3a3801fa0cad6fd839033f
  • SHA512 9f3926d9ffaae5420dda0bb18a9f481b125c2029ded645d2076582e62b06550874afa6324c016804116a4234fab66d1cd58d17a2f9cfd1711d7032bf5b099cc6
  • MD5 SHA1 SHA512

  Score

  10^/10

  agilenetrattrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2