Extracted

• • Target

    Quotation.xls

  • Size

    750KB

  • MD5

    27c76cb1e3d638cf0c4bbefdc8d367d4

  • SHA1

    92fb546ff0acd1754c0590b2f1e2ed1613b26833

  • SHA256

    9c311263e7a86c9476cff8e849871d3c7b9ec68462b2be1ad867b927b8290469

  • SHA512

    e751cdccb4b84c9ec5a89290644e2997c86923867efb9ea205688e2444e638e21ef936bd9177c0db076d08dde4c358a2887affd5b7f492e4690f8d461d88f6a3

  • SSDEEP

    12288:bIN3rDx7XXXXXXXXXXXXUXXXXXXXqXXXXXXXXfTmDodIN3rDx7XXXXXXXXXXXXUP:Wr5XXXXXXXXXXXXUXXXXXXXqXXXXXXXK

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2