Extracted

• • Target

    OTTIMAX RFQ BID1122263.xlsx

  • Size

    1.1MB

  • MD5

    61b68ed859f55e970b3b4b49e6aa3890

  • SHA1

    0621ceca3448c427848777e383c9b9d9549fde21

  • SHA256

    8447a77109db948caf2aeab8f22ecffb5fb15a83286c7894b0d9a06c48ed3e73

  • SHA512

    1ead6f9dc9428d47aa9419dc6ba1c2f753806b93df893114e3baf06c067c78667b4ccb37af5554f626ddc84dd91ab21025346243df9cb6c9d34485b537b7a11f

  • SSDEEP

    24576:DxmdOBUO2GqbAq+zyFGbTgV/S9MLk2zP38rkwuX+au+H:lnq8qGoIgGck2roNuX++

  Score

  10^/10

  formbookhwu6discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2