Extracted

Extracted

• • Target
    Request For Quotation.vbs
  • Size 60KB
  • SHA256 eb4c64f160030cfee24f7fe0a49479bb538e746b2c73e9574f8fc80e36d3cae0
  • MD5 bd95ca686b05d785e18787c30c73b484
  • SHA1 5f5a15d04fd5099a95748a22b0ae668cfce3da76
  • SHA512 4ffb81fc3c62dbf109fb15bf006fc9d868a50441002124b82f83388692c6eaa6db71f5327afd9932f30375db153472812b46c4130ef5bd3516664077a34f92a6
  • SSDEEP 96:qikOfwux6SHxCQSjAodLU6R7VuY0IU1LxmQocVSjCD8RocgSSjAuSG6NnJVuYoUQ:xez8OithCe1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  zl28discoveryexecutionformbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2