Extracted

• • Target

    TT application copy.xls

  • Size

    1.1MB

  • MD5

    4a75a837275e85d09aeabeb442ff7c93

  • SHA1

    fe410acd91fc5db51cd48306877b356413349e6d

  • SHA256

    99952f4d1441b505954c124f3e9139f6c8f4a8472db437b5f5e981d37b0d8837

  • SHA512

    9ed72e1eadcfc2f21514b604640cf2acf65c79a775d739364020c68946f71b57938c4b80bc898573bf1406a24131c17528205fd84b32375a438f778c01d14135

  • SSDEEP

    24576:0u9VYltDLwBkN5DLwBkTiPtVIt2T7czefPNAMFk4:0uJNAQtqwkCNAg

  Score

  10^/10

  formbookne28ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2