Extracted

• • Target

    faa9c6e03a97635e6636c22e85ed3fbc128c047d25fbb6d1cd3eb599c286ad74.xls

  • Size

    1.0MB

  • MD5

    1c741a897b190b202783b317d1bb61d2

  • SHA1

    a64f0312d4cd51cf061170384d2e54aa4f70e6c3

  • SHA256

    faa9c6e03a97635e6636c22e85ed3fbc128c047d25fbb6d1cd3eb599c286ad74

  • SHA512

    3c1726e895c5f0e772370403f0fcae53e500c6607d994a88335180aa4619538a07f31b24b2f9049423b3592b6761c83e7dfd56a5004c61d54fb1ad8b2f1bede0

  • SSDEEP

    24576:Jr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXzmzr5XXXXXXXXXXXXUXXXXXXXSXXXXXl:Ueg9qu

  Score

  10^/10

  formbookpgntratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2