Extracted

• • Target
    3041000.xls
  • Size 452KB
  • SHA256 595e795d2c8aeafe3af742ef4f2a404546d55ae58d966d88c3d2880074aab591
  • MD5 c444d11c01517f1ec52b63a6484bd512
  • SHA1 17784bbb9a63e836ee2c1d05cc26b773ad51a72d
  • SHA512 629121bca1095ca0275003f8a3d85c3d0ec0b71f8592b88c5a2447fa29c559dd79db2299dda60bf15d25f8bed24b8282ee2317c501855461c070dd77aaab001b
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratpersistencetrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload

    rat

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2