Extracted

• • Target

    03072024_1606_02072024_DHL522918767AA.docx

  • Size

    16KB

  • MD5

    f97f213bb0f35c63379e436ed801f3cb

  • SHA1

    a3d28a24d4b3e1a499873d295195bc41a5fd843d

  • SHA256

    ee701c82b92562f01edbb96ef74f5db9b59ba479e87bdd01c75da61b94203e41

  • SHA512

    ed8c715d6472b37d8874c4fba288f3c515a2b43bd7fbec8c4cad70f2e63d925d0daea27346be50a7aa4c5801399a8171a6a1f14b096c0725e6fc929482dcf4a4

  • SSDEEP

    384:UyX/fCXWws8PL8wi4OEwH8TIbE91r2fRK/JYjvigf6vqsp:Uc/+j5P3DOqnYJGuvNf6vR

  Score

  10^/10

  formbookch25executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2