Extracted

• • Target

    OrderP.O_R477304.xls

  • Size

    1.5MB

  • MD5

    8fad80b104bd3234323be9171aed903f

  • SHA1

    e1190346d14c15788685e77347a827f7086adb2c

  • SHA256

    b66c265b35372a58775ab68db5392014be36b745f4647df6c3da1c0a7aab82fc

  • SHA512

    a1fce52b3e0958a8297b3adb0b0fdce46952ad5b96ac3ab6ce180f4d7e96dd39f5ce7015d0a168299c999776420b3d87d003bcac91eff6b56db359c1de53277d

  • SSDEEP

    24576:1zxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDgm/qr5XXXXXXXXXXXXUXXXXXXXrXXX9:mP7f4Qkle

  Score

  10^/10

  formbookpgntratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2