Extracted

• • Target

    20VOR005760.xls

  • Size

    37KB

  • MD5

    abc73f6301b9f828dce46943b7111f29

  • SHA1

    fadb21a70ab5923cbe8e8deeb36af5e07efd0e87

  • SHA256

    ac0ccf59d64faf079e0d4e93ec994865214aefd0899f644da81f8e748e4ee153

  • SHA512

    00f1499e6db64cf9bc94bba3a90382f5b045a3e291e65ef8db68a916cf586353d48ac7509c30c14c0da1b1557ac96ba60cf2a5214321395892473634dc56b813

  Score

  10^/10

  formbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Use of msiexec (install) with remote resource

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2