Extracted

• • Target

    Swift Payment.xls

  • Size

    537KB

  • MD5

    3ddbb73564bd5da178d353887cb82cf1

  • SHA1

    9e7cfbac422ef392dff72228be57a86f37eed26a

  • SHA256

    eaf3b9c1bdaf72da0a5d2a1a8c4f128712463c558e8af23830126bf07ef63847

  • SHA512

    c4cc01cc620b8f5cf457221679760f5a36e32cf1d2fa42f3a30bac8949bd152ab0097e2ce02da70111533b0b21c43a71200aba97362c0270623a56a2b1d44d0e

  • SSDEEP

    12288:pNsZ4UeZzxvJLrl0jHUxIbuKlt70AFg7JzXAZo+r:s2xxJIUgL0AGkb

  Score

  10^/10

  formbookb48ndefense_evasiondiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2