Extracted

Extracted

• • Target

    ORDER.docx

  • Size

    10KB

  • MD5

    4a703e4cdcdb820ba8fb7a4885944e83

  • SHA1

    9161b9fa57542ccd1857597e5e13e2ad89dbd2bf

  • SHA256

    266fe6d2cf821cc2615448990b72401ee2772b8f8548e96482c2e9697e694f76

  • SHA512

    278b9ce372564d1de8227fdd724d4934522ecb5c814316058d4cf663593ef4cd2278b285e9543948e0089cca732e5bcf86fe92e6994a0e5669d0770f38512365

  • SSDEEP

    192:ScIMmtP8ar5G/bfIdTO2namWBX8ex6y3dvR:SPXt4ATO2nosMdp

  Score

  10^/10

  formbookdcn0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Abuses OpenXML format to download file from external location

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2