Extracted

• • Target
    PURCHASE ORDER-34002174.doc
  • Size 1.9MB
  • SHA256 7b2dc8bed33f845ef9929cdcfa5e896312443bb7c9fc7c79e586018653de6791
  • MD5 3fb187ad71b93aaf468fe5121ecba6b3
  • SHA1 5f7c4692da6dfd481e76beb3321e5bd64f203a12
  • SHA512 6a275e8b15db8fc5340b6f1a89714566545ec2a437b82b7e97d94d05dd2962c30b72603b88eb1733ad5c80a897a4467786b959a365a801cd5e85c98c1e038f7f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2