Extracted

• • Target
    SYD3441.js
  • Size 122KB
  • SHA256 28c2751aad8d27f5da99f5c55f009f9321eceeb3b68a834d58cd36502baf3981
  • MD5 dbccffe944b2a87af23f838916478435
  • SHA1 3abec065253e8b2c3488c874b3888c4ddb0d6bbe
  • SHA512 c5a214e62768cf0f47bbcf91d1ce931b8dce99f94d98e7efbca10a4ff0ce7ba7a8297c7f347b9d321be2de977d1e4609a43d79479e0620e9898dbc2ae49382f9
  • SSDEEP 3072:wsWsWFkLJOc+reRU4zV1tP4cxDR2v5O5UvicLp1ji02ATcfotlQp8OXrAEyjYzZ5:oYD
  • TLSH
    T190C3F20833D54C7A71732B5187EB249A9A577A92BB35462B804D330D4FA344F8EDB72B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2