Extracted

• • Target

    RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe

  • Size

    959KB

  • MD5

    a4be50bb39110e49c1d2fc87ccc12f56

  • SHA1

    ffc4874f95b0c774ad54988350128eadfaeebc23

  • SHA256

    b967a8b7765a762514d4b8d172fabb655af83d7279fd15cd513e217675ce96a9

  • SHA512

    241476b5ab26dc7a8673daca8cb6b76b46b9e87092e09e7db643368b8514d439e1bf502a42b9f6b082ce2fc92c3ca2141bd34e8068bc77820c06d4892242f575

  • SSDEEP

    24576:hiUmSB/o5d1ubcvLiUlytyo/bfUbycmjNlscnVDO8TR+KDV:h/mU/ohubcvhMXQb6kcROgIKD

  Score

  10^/10

  formbookbs26discoveryratspywarestealertrojanupx

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2