Extracted

• • Target

    Attached Proforma Invoice.exe

  • Size

    678KB

  • MD5

    9f0e000d75cf201d56f68e51a0c43cc5

  • SHA1

    54d6592876e9261109fbd60ae2e078f475f74f1e

  • SHA256

    02033ee5f18dc5c14cca3e808111693ff1b41d8d705268ae55e86251fe6bcc8b

  • SHA512

    fe72606ae529ef5522b7681b66118c516c6f3ea55844441196f1143ab684dba5daee89dfcdf957b291a16ee862d575accdfe1b45837d4ac01645da894492f64e

  • SSDEEP

    12288:+J8P4O2utBLvuQ4ZNn1AjnJzQFftOZCcgy:mIWutBLm/NnoJzQFW

  Score

  10^/10

  modiloadertrojanformbookn7akpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2