Extracted

• • Target

    DEC FORM.docx

  • Size

    11KB

  • MD5

    d544edf8d39f07d5088b21a68c82e4d4

  • SHA1

    5bfe1ce0407cbcd07bb138ef60bc618ab088257e

  • SHA256

    3cfbe6d313af628cfb2cf9f50cd12e1da119d8b0059ad812da885f90c58147eb

  • SHA512

    33b4aa3ae5744f2af646aad5324b6e2f611c9db6c8fb08d7d434279ee8c5f95d5da847843146ea26a237f3fb2bc5808e538888cd20e3c2ae508d9b9d05ec0ce5

  • SSDEEP

    192:kya0N5lclWm4N5eNA2A+EnVs+mg1SoB3cJYkO36PvPKbwPNY9JcWezUlQU:kyX5lclWmu5+A2bkBdBMJYkOqP8wPe9L

  Score

  10^/10

  formbookoy30ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2