Extracted

• • Target

    c4036ae358676bba732bcb78f6f2768b7076074dff7eec3a74d745dc065e58a5.xlsx

  • Size

    1.8MB

  • MD5

    c3955c311b951719d7ab4985314fbab0

  • SHA1

    f48587590c94133e1f33f10b4da85c5ae151da09

  • SHA256

    c4036ae358676bba732bcb78f6f2768b7076074dff7eec3a74d745dc065e58a5

  • SHA512

    aeba2ac07f89ee650a169e15121c8bcd08cfe77ee5958cec0fe5bc59da27097318413900bfdd31a29e2c21756f19bfd5bc51dac01211cad75eeff1797121b858

  • SSDEEP

    49152:yKHGYSIGQZnSCR0JfTfDZMsSdg3e8mr+0sUj:BHfSb7bZjD0su

  Score

  10^/10

  formbookhwu6discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2