Extracted

• • Target

    Jan2023RevisedQuotaion.xls.bin

  • Size

    1.8MB

  • MD5

    41a540bc320dd5904fcb6eec31fbe6c7

  • SHA1

    ada4de8ee7c8363b9e659455b91a8e472092515e

  • SHA256

    70a767afae13b01f89e0830ff47ce2ccd605544173539c720575a6910450548d

  • SHA512

    3b51336041722e95fae1d6e46b3f2a0b0da62dcf2c5b7df932a7b6e808d038db63a89de662ce9a246601cbb1550dbe3253edc78b0e48a467d71c057c8274698a

  • SSDEEP

    49152:jLKksicXYkFicXYkyyGebJUbkZP2J++yDV231sQqydZ:noX/XiyGeGkA31s

  Score

  10^/10

  formbookie59ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2