Extracted

• • Target

    ORDER.doc__.rtf

  • Size

    31KB

  • MD5

    a107106fb43e0ded99c1002938703532

  • SHA1

    4833ad7b724197c62db8535466366821942c3ed7

  • SHA256

    6e2449ed97a675583b51a2f9f67a2d576a97bf0ea8b780e82eb8bcc563cf9cc5

  • SHA512

    63a2375cfa7532ce0c6fcbb69695ef11b6e51de2d0e4d7c1ff7ddb2ba6b89c421b7b6e771088637326b5198f6d17941a964f7dfc3d5707319f92650e8af8cd87

  • SSDEEP

    768:aFx0XaIsnPRIa4fwJM869X+1+SVRDvYYmq+P6zQW5:af0Xvx3EMNxMTnxmpycW5

  Score

  10^/10

  formbookw086ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2