Extracted

• • Target
    QUO684506.xls
  • Size 420KB
  • SHA256 1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0
  • MD5 65ae45789b58f1e03a4f8c3f178e6b30
  • SHA1 4eb87b3825da0d23d7f7091c2976e1e95cc40907
  • SHA512 6d7da073e7280bf84612920a6371b19a1226fa50747587dbfe9fe10ed6bdf514ab8b171605d34a0a090d5f9ee3dbe4ec5e6fa379a73dc4675c8f4e46e359e864
  • SSDEEP 6144:NZ+RwPONXoRjDhIcp0fDlavx+W26nAHu8uniSHBMixiMK6G+ZFrTUvCp4sJgpQMD:31iQpozwjTqCfgdhd/+Z4uCz2BFmDiP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookht3dratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2