Extracted

• • Target

    Honey ORDER.xlsx

  • Size

    1.4MB

  • MD5

    b0acb4945db74ef13b18c1a070e23199

  • SHA1

    0e892062df26a3f14bc88d79ebc7fd8ecddc5009

  • SHA256

    bc49a8d949163802d2b46f08a0998a39376cc5bde24377c4d40e11b8bc4e2409

  • SHA512

    8a40435b65c4641eb207cf92f7c9b722186e51e0f1def0cee2053c1f3b990184cae86b7ed02f9da9e8fcef0ef7ca9f95c757570b396a65cc498dbb9a5c2b5b4e

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2