Extracted

Extracted

• • Target

    HBL_2022_790643.doc

  • Size

    21KB

  • MD5

    1bec2ce33fbfac0bae25e2e97f192172

  • SHA1

    d7bcee3c070796b2c618415533f57b5d9c48f5be

  • SHA256

    7583d99426f32a09f530dc3746df2ccb44aada08f258083565cffe4491f0f6d4

  • SHA512

    6b62df7ecbf214a8e000474e36f450eaf84f67aaa8fc32a1f4d5d411c222ea94f0a35625580d926663f7366b92206bde7a1441528aa8c523c20fbd8101f9188d

  • SSDEEP

    384:Py+I8QPgKLToFhryQ9JElr+GOilcLdXj1PVq8h7taiw0KIPw:P8++ToFpyQ96/OilcpXjB4u7nw0KIPw

  Score

  10^/10

  formbookxloadertbgnloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2