Extracted

Extracted

• • Target

    17a8ec56dafaad109906330a0ccef3dbb3592fbf21c33cc26255a154fe3976f7.xls

  • Size

    813KB

  • MD5

    b5c98554695c6d71e28bf2ed1a10098a

  • SHA1

    40d789b940747f88f40cdd0cbc891486cd0868ec

  • SHA256

    17a8ec56dafaad109906330a0ccef3dbb3592fbf21c33cc26255a154fe3976f7

  • SHA512

    3817d96e370d28d92d2ba05ab50cfed03c8afbb357c670964c190273e1f3fe09aac053ff1913ec8f51fe868e153f9b53ed471c74200b0d7a6ef83da6a7d1947e

  • SSDEEP

    24576:bL8r5XXXXXXXXXXXXUXXXXXXXSXXXXXXXX9mZr5XXXXXXXXXXXXUXXXXXXXSXXXr:DSW

  Score

  10^/10

  formbookxloaderpgntloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2