General
-
Target
Shipping Doc_Posen 2011S.xlsx
-
Size
1.9MB
-
Sample
210115-ccjgdtvdmx
-
MD5
6251595d49a8e13fd50acdee711a4907
-
SHA1
3858854ea990b7b7093a11d817a71e78153f42c1
-
SHA256
3519fe69cbcf16296c897fae7afe09ce22b9d3b8ebfaf2be8d958d985c9104f8
-
SHA512
4074c4decfe9790dc3605e183e2dd536446ec0404194dd1df53dbccb3de9f5b0db55df603713b5e94d51c60c64091e9cda576c84496d783723663b3691f3d689
Malware Config
Extracted
formbook
http://www.waverunner-fan.com/pp2/
meredithridenhour.com
foundationsseniormanagement.com
sallyta.com
msmonlinellc.com
entreprisesfr.com
neadclunlounge.com
lexuscarbonfiber.com
electroglas-probers.com
investedgefinancialinc.com
blm.healthcare
workoutmagazinemx.com
edmondsagent.com
rodrigzart.com
standardstripcurtains.com
carrier.email
hifan.info
fhcqtravel.com
legacycream.com
topfurnity.com
solids-development.net
Targets
-
-
Target
Shipping Doc_Posen 2011S.xlsx
-
Size
1.9MB
-
MD5
6251595d49a8e13fd50acdee711a4907
-
SHA1
3858854ea990b7b7093a11d817a71e78153f42c1
-
SHA256
3519fe69cbcf16296c897fae7afe09ce22b9d3b8ebfaf2be8d958d985c9104f8
-
SHA512
4074c4decfe9790dc3605e183e2dd536446ec0404194dd1df53dbccb3de9f5b0db55df603713b5e94d51c60c64091e9cda576c84496d783723663b3691f3d689
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-