Extracted

• • Target

    Stocklist.doc__.rtf

  • Size

    1.1MB

  • MD5

    bd80accc4a1535d881c3b33d187f1eb5

  • SHA1

    e68efac7e694a36e6effa9d4ff5450a9c4b23c90

  • SHA256

    f94a50338954420bb77446d6962361193e5cfde7264e4554a64fc38444fc029c

  • SHA512

    9e813b58cc26b8f1da4a24b6932f12fdac7326990a4eb7ac0ee0b52b5881c16c84816e020ba140dce32f8a048ee4c8ff60d4bb879a47bd3aa5c08c5b68b92c03

  • SSDEEP

    1536:bJ/pGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+z:FHf

  Score

  10^/10

  formbooko07oratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2