Extracted

• • Target

    SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.29632.17941.rtf

  • Size

    265KB

  • MD5

    1982efd383b4f28fafb917132b87478e

  • SHA1

    6cca35d8bc2430bdf715696aece16ca34199f418

  • SHA256

    1e7026039a8201b0d0ef23a2cb837fbde785f4e0895e843ec04c975d60afb99f

  • SHA512

    95e75edeec94d59fc9eee3e17866e859f23448a7fe2e21039b14342455be8f2daa4bae60aca0ddb658a7492a811237ade1b433a242c8159d6c4918870a2a1fbb

  • SSDEEP

    768:YwAbZSibMX9gRWj2plPRMz1tL7QZiWuuSJCUXo75:YwAlRTeB9MMWCCUXo

  Score

  10^/10

  formbooko5guratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2