Extracted

Extracted

• • Target
    (Excel 64-bitni) Zahtjev za ponude.xll
  • Size 1.2MB
  • SHA256 98ff2b6daf8be17c2bd6e4e03dc3668a63bf69f43a99ab186de8b555fe64f280
  • MD5 d656b559619ae394409a53c1e2efc324
  • SHA1 b94fde8f0ef133255e2d03e876e8a32cc2bb50ab
  • SHA512 8eddcce614e4e1a4347b13eea66f35972a20d747269389195313bdc0c0e1ccac4180dee8ea119836f4ea8a001fef342866131d1776b258929f71a2b9f16fd221
  • SSDEEP 24576:2oOOMX18+QHT+dn//3yJ+oPqlxWDB/BdfbPXf:2oOOt+QHsnnpoCzWFHf7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdn03evasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1