Extracted

• • Target

    Invoice and Quotation.bin

  • Size

    289KB

  • MD5

    2e07da5fa7627362c6666c94210a40fe

  • SHA1

    8fe040d7df872ae78e702f11827bd236a6201981

  • SHA256

    c58e97524572e398ed81f73169c0fad3cbfd691761b997cf09be2a69ef5a6be0

  • SHA512

    23af93e3f00ca661a33e03d1063b3c1fe9b974c62ef136233092153b7b9839e8a807bcdb24c3b079c0d28aa1909e0e543dbf102a569dfa846ceb1e9db095fe5a

  • SSDEEP

    6144:owdWxpYqbDdleIkpq7pvzkh3p1YCuzcAGz7FGpxvFu20RCp93Nn0:YxpYqbDdleMdzktTYCuAAAilNphu

  Score

  10^/10

  formbookg09ediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    qxbcmmh.exe

  • Size

    117KB

  • MD5

    65facecea332bbb51b802e66b329eb18

  • SHA1

    019140dda8ec2d92fe2597c8949208a7ebe95c6e

  • SHA256

    c6935a83136101694625c5904af17387b6cf2a2a0b91ae394615e4d1fa61bb28

  • SHA512

    d9d241441345f5c2e0bbd9e41489d9907d5c722f030249fa0f8285c13c5b3c872a8805a8b673060cba16f72a4ad8feba3a1ffd93524930193fe08bbe443a3842

  • SSDEEP

    1536:KQraTSjiYFwlvwVC1TsJ66zafChiC7f3OAcysEzdwcOGr2c8oA5YfnsWjcdCon:/jFwlvweI8kaZwmAcuYXmfIXn

  Score

  3^/10

  discovery
  behavioral3behavioral4