Extracted

• • Target

    SecuriteInfo.com.Trojan.DOC.Exploit.S.26451.27250.rtf

  • Size

    1.8MB

  • MD5

    189183f0fcb3ddca384604d88a6f15ae

  • SHA1

    19b710e99726b7d70b3ad407389d1efe0f6841f4

  • SHA256

    264f0534cab513547b16dd6089b22b8e87079d403159ba4550dc22c1c5ba4311

  • SHA512

    ae138592369fc7c565f5349b542213417c8c6143e5227dd91561a6372bc34b1de8cc62a4e4b6a388ac9e81c6a8ebbd3076bc73863a496a837d3706baa891558f

  • SSDEEP

    1536:XsdRLURHtQQQQQQQQQK3QQuQZbJt9Xp9EiQZIgdRXqgZbJt9Xp9EiQQQ9QkQQQZC:XY3K

  Score

  10^/10

  formbookkk2uratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2