Extracted

• • Target

    PO#9943441.xls.exe

  • Size

    887KB

  • MD5

    d805ae4b8c9cc7d49432a7dd3f5de693

  • SHA1

    cdb73e6bd75bf2b7a4ef54435a5dd0179c67693b

  • SHA256

    415c22ceb1927b67c21bd55423f75713b29ca6950e806387e28abbbf19ccc8bd

  • SHA512

    3cd4ae4964e0a491f5819c554aa1379f98d9b834590f309b450e8943892a322a7ee5a17a925f311dc83155eaa7a058fe75b9ed969e6ff5155160d0bfa4c9b2ca

  • SSDEEP

    6144:0V2wunldSL9/jlaD8jzurlsY4/Pg1IWSzOvZFTiEExL08koTxBroW:0V2ruLxjlaqmlsYKPg1k4FGEE28V

  Score

  10^/10

  formbookgdoagilenetdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2