Extracted

• • Target

    SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xlsx

  • Size

    250KB

  • MD5

    ba0a934b6dd5af65ca9a82782d44e843

  • SHA1

    5957a4921c66e0bfae31d096e2a86a9c73feb5b0

  • SHA256

    0b97d2123754dc9e52e88001fc59c0343b37965172255bcc4b1d592c0df69309

  • SHA512

    989872eecb46877b649e6a4b17c79a6a4feb27b140aad43ff4d9215c364a2f94ec40fba3b25e34b68b7334adb76805daf434ec6eb6c99ff44bc7928f87162005

  • SSDEEP

    6144:yDZ+RwPONXoRjDhIcp0fDlavx+W26nARy0f/8v:y+/q

  Score

  10^/10

  formbookpr28ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2