Extracted

• • Target

    DHL-Official-Returned Document_Details & Forms for shipment_Monday_03_10.exe

  • Size

    439KB

  • MD5

    4bdca6f10a1373637dd801a75fc1f81c

  • SHA1

    3e1c99df19444b2441add587488d08d104b1f0ce

  • SHA256

    c4d1c39814d1e2d2aff5e0bd608585c6ff9c932c3480d73eb30310cf3c4be029

  • SHA512

    ef265050be955af1cb9ad3f811135c4c47c95ed1f1ca6f8aaa1ec2940452d53c1e923a85c38a5bca9efe402782c85e4e7e992acacfac02b2bff23559dd69d9aa

  • SSDEEP

    6144:1wdzgWHDaQSfwCnF3a44NPaQkodOEisSAv++Ki:AtsfJ3kaQlOEijw8

  Score

  10^/10

  formbooksfkuratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2