Overview

overview

10

Static

static

nuevo_pedido.docx.exe

windows7-x64

10

nuevo_pedido.docx.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nuevo_pedido.docx.exe

  • Size

    1.0MB

  • Sample

    221201-qned6afc6y

  • MD5

    4f3ef54cc2a4028e954eb275760a8203

  • SHA1

    0705497325e8ed2e83792ac2c08b0ee7cbeecd72

  • SHA256

    77dc20ac123646040725522265e3144772f5bfc77b8aa7896fa33e6c601ff498

  • SHA512

    5c31cefcaf349799dbaa83da39c82b9688d0de055bda7f97ab47c8e0353b0f2c869a297391d0d1216c7b18b68eabc6938dfdb0f0fb593b01a76fb058f3672e1f

  • SSDEEP

    24576:wlOqaEByj4HVHONLZkjwf5uwGPnTiwAAgEEY4:w4kHclZMwBZ2TQp

Score
10/10
formbookqwloratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

qwlo

Decoy

HJicvGvi3ve8hBxVn3IeGdhLB01EnQ==

Kp8ox/HNepRaJ78yGH8S

siM+CGMhAxTwkoXbPLSE0JQD/RV5n5Y8

I1ErJkNb/zsN

LmAzPtnXaJGdQvkd

mxX5GuJUL4L04Q==

90oPN1wty/rDmCgZj7dliUGscIk=

7EKwYKA2EzsN

KmDNWMMaNG4uFtQBMqY0rxFOYw==

KlxekbSTGjMmCgZBan8=

bnc+UEe0zOw+F9syGH8S

veRUD740TGXqr0176YFPuKKo

GbCJkFzG8SmzchY/dwiYBgA09xZE3jbSXQ==

J6eczJ1jyyYq95M=

h7AX1FCw3muk/AZBan8=

q3knw/TldLg6vtrG+nRPuKKo

KYj0iLy4T6FyPQZBan8=

y+xN3UT90/HrqobsNGY=

V5iVtK4gNUyUGe/JSA==

QZ/gcLimSmlpNAZBan8=

Targets

    • Target

      nuevo_pedido.docx.exe

    • Size

      1.0MB

    • MD5

      4f3ef54cc2a4028e954eb275760a8203

    • SHA1

      0705497325e8ed2e83792ac2c08b0ee7cbeecd72

    • SHA256

      77dc20ac123646040725522265e3144772f5bfc77b8aa7896fa33e6c601ff498

    • SHA512

      5c31cefcaf349799dbaa83da39c82b9688d0de055bda7f97ab47c8e0353b0f2c869a297391d0d1216c7b18b68eabc6938dfdb0f0fb593b01a76fb058f3672e1f

    • SSDEEP

      24576:wlOqaEByj4HVHONLZkjwf5uwGPnTiwAAgEEY4:w4kHclZMwBZ2TQp

    Score
    10/10
    formbookqwloratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks