Extracted

Extracted

• • Target

    Nuevo_orden.xls

  • Size

    1.4MB

  • MD5

    3ec6082c0c3d4230f50fb5492fca4ce5

  • SHA1

    7785a87183386d911ef22ef01f56a124d5bbb4ed

  • SHA256

    fdd33a137aa5e4b3a1b1268297372067e246a8c0d9a812fb691a2d685444308d

  • SHA512

    09dca1b64c7f43f6855f530462079213ab8ae14f6eb4e70720d236c0ff7407ebd144880ad3f230f6f3c727866377fa75622baf2db476f7270e3ff8110bde516a

  • SSDEEP

    24576:nzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXD+m/Vr5XXXXXXXXXXXXUXXXXXXXrXXXx:I0S/XpWUe

  Score

  10^/10

  formbookxloaderctaploaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2