Extracted

• • Target

    INVOICE56K.xlsx

  • Size

    443KB

  • MD5

    4cdf1a31c469b31f3a8beb518ea7463c

  • SHA1

    b44fb9c8b59ad5c465c9c30ada4f768247460c30

  • SHA256

    c07f1a20f4ec699e3f2eedff1e2c08501ab1ab93d4651edac4fd0f950e02fb89

  • SHA512

    762a1d304b1633cdf53c9dabd627e25ad5fc86cb7f5644178c9d7cc81b607db9d1e422a44fd5ea84217779c94a14459a2ddfcb9c41bb042267b30a90e5d74d5c

  Score

  10^/10

  formbookhs3hevasionratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2