Extracted

• • Target

    ad208fe787c74f455a317a5050c3462c8236ed6e3c58f9c6082147ca09902335.xlsx

  • Size

    1.9MB

  • MD5

    22ca610098805557434a4b2810329689

  • SHA1

    23cf1f231d4b1a53416c3f72accbe8e21b4b1fc3

  • SHA256

    ad208fe787c74f455a317a5050c3462c8236ed6e3c58f9c6082147ca09902335

  • SHA512

    a333f8b243c5482302857834f185d934dc6f149b587e40ae41fc30e61936f0fb4c55d0c543f590dcf714fc688abfb018655c86c1e2c10d8ead393ec66b06e910

  • SSDEEP

    49152:0kVgTbHTs6oLbLvnlfRzlPlJfhQKyd2jgC0c+QXjI2yD:2TzTdoLbLvFRzljJed21+yjIB

  Score

  10^/10

  formbooktb8iratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2