Extracted

• • Target
    Overdue Invoices.exe
  • Size 479KB
  • SHA256 ca56faca9cf660826fa63147d03bf21b1ea7221cee4c2fcd6e5bc49266176fef
  • MD5 3ddc6875fab1c8465e6c5e5481574720
  • SHA1 362e8143c54745ab48184ebee94fd462deb423b1
  • SHA512 2cf7302577dacc4eadc85c5ecdc41e8574498bc91ca271989dfba795e31123fa4df1615bd1478ac4ed7d5bc64d5936eab5b789ad188cd579d508aec11b465db6
  • SSDEEP 6144:G6dQC6a5KqBFftrh6pIDy6JLqbYgEh3tGOw6GE035XZJ/uvc38OENSarpWJLgjO6:JNBFftF6CDyZREhd8EiXbuRpSar0J0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  b25fdiscoveryformbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
  • MD5 0063d48afe5a0cdc02833145667b6641
  • SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
  • SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
  • SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
  • MD5 6e64e5d5f9498058a300b26b8741d9d5
  • SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
  • SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
  • SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6