Extracted

• • Target

    Sept order.doc

  • Size

    634KB

  • MD5

    4c8e90937a0516f48aa3b8cb17cbc7b8

  • SHA1

    89b8ff3dbb714d2ff658e0c09a65dbc590e19da4

  • SHA256

    7b6a3f5f885e00679f66af1168236c12b3db888689fe8bb7879f994f4160c352

  • SHA512

    84be326e914937e3ebf91824d701de5b2c14d4f4e30dd0b0f6d571f99ceebbd24e6ed947d748e084ac3fe69cca1e43f21b64793cb63130fe5a969917b9314391

  • SSDEEP

    6144:bwAYwAYwAYwAYwAY9A3i0AJW6fiI5zXaW:+

  Score

  10^/10

  formbookbopidiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2