Extracted

• • Target

    DHLTakip-pdf.bat.exe

  • Size

    1.0MB

  • MD5

    fd533f80090c761f06b499dd63f5cb10

  • SHA1

    2534671af3824e6b8edcdbdf6e06789050074e0e

  • SHA256

    f7b61d74ed091d52a93af97e15333b59cec299e026647c58830ccf0baf3d9c91

  • SHA512

    083e8e1e00c39b9e5e708f0f3149313ba46659e7503791aee5ac31deb64413c7890633c4f3e4869abcefd55880e2e2b538b1003de3f4944b6979cbe13e049508

  • SSDEEP

    24576:+5bgDPHeGskuYMexXYvRCEOYkYRU2fNYwYtYPY:+5qPHeGh5ovRH1bqyuXOg

  Score

  10^/10

  discoveryformbookguloaderil30downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    cf85183b87314359488b850f9e97a698

  • SHA1

    6b6c790037eec7ebea4d05590359cb4473f19aea

  • SHA256

    3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

  • SHA512

    fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

  • SSDEEP

    96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

  Score

  3^/10

  discovery
  behavioral3behavioral4