Extracted

• • Target

    new list.xls

  • Size

    1.1MB

  • MD5

    15d4b709ec7829706e540458e34d5b40

  • SHA1

    4123024df7d79c4402bf55a99600e15ebe256f8e

  • SHA256

    d11429eb77b9fed70574ea7fe72b7d48355dd319db3b9b8d802e766b380ebae6

  • SHA512

    c458f62bae622b3ca0f48a5f33a7634b259076b49e39f5f443c991460be657d79951ac7a45595fc3ba6b78739e4e28c5f3cf1c6986015a126870cee4c08d684a

  • SSDEEP

    24576:KLKfSSMMednE4SSMMednEuSSMMednEe+MXU2SSMMednEWWoUA4kJUsQ:KLKZMJMnMF+MXfMUo+keH

  Score

  10^/10

  formbookhs95ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2