Extracted

• • Target

    Report and Contract.doc

  • Size

    2.8MB

  • MD5

    2020683c0740feb8c7a41ea70377b7fc

  • SHA1

    326a0155051677653084e841125984b63b30666a

  • SHA256

    3a0b5b12f26a4751964e2660ee62d20b192e00a044cd322f6867acfa25e341bc

  • SHA512

    b550381f4874e6d0d5d8e7af708f4f122aacbcc1b29fbd7dd528751166591458f1bf2fc725714b2a771cd430a8a02a99999df4a5fa4ee3f277137f2bf7263431

  • SSDEEP

    24576:l0wKl7r3ezbhrC+1J5nbVlvTagtZwAQd5CTkY7PGfk/sGvidzy5AghAoDmqaepIn:O

  Score

  10^/10

  formbookc23ediscoveryratspywarestealertrojandefense_evasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2