Overview

overview

10

Static

static

SHIPPING DOC.exe

windows7-x64

10

SHIPPING DOC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SHIPPING DOC.exe
  • Size 863KB
  • Sample221115-pkg57sdh42
  • SHA256 7cc325dd19e4ceb61b666da2a847b3f4f65e945ea1b71d7616cbc8d2dbea30d4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcfvcratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • cfvc

Decoy

  • qFcyI8OAPHKap6ubfQ==

  • NuOCNnr/zOqy1xM5AN4=

  • CnHfypZMLKQKgKaaVw4J1g==

  • 9WpDFnsiwEyoFko7+GYiyo55

  • zUKhZPi3f21+ux+L

  • vqqeiTTPlz+cnQaD

  • GLGZh9zop+UvsCtBEm9x

  • eCUGyUEAe9hmj8KgaA==

  • EvXUn0s63zJyoxQfCGQmMZRu

  • kVy6iO/FuRGD/A==

  • +tg0M82KQk7fX4XXoYIluHMEFhbrzMk=

  • hP/nqutI9DR+0mBnYA==

  • cwrq1kLJd9QzqtQq9QCc7hHV9FjjKSvU

  • eE6vlcLHxAHZ7g==

  • vpKQL84+30y4SZpU/Ox5

  • vbfnlWZmAj1aVbCdbA==

  • UNQwEfT8tzbiL3J2Wrjm3g==

  • 02LLqYRY9SeDIHwK5pFjYrg=

  • PhkLzj8IuT6R7v3lxlBYwqO69HReqnrF

  • mkYwC5lsF6cDS6RU/Ox5

Targets

    • Target
      SHIPPING DOC.exe
    • Size 863KB
    • SHA256 7cc325dd19e4ceb61b666da2a847b3f4f65e945ea1b71d7616cbc8d2dbea30d4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcfvcratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks