Extracted

• • Target
    8e3ffb0282c016ce500a81a4e7a5f13e_JaffaCakes118
  • Size 506KB
  • SHA256 370b7d8656ddabeb6669b24da32cd047ebbd977efce6047bd26e8326a98c768e
  • MD5 8e3ffb0282c016ce500a81a4e7a5f13e
  • SHA1 3f0acf30be8406bc451bf43ad5a704c066bd89b5
  • SHA512 ea9cf7dd7afdab45021e88d3f258d6d38d91b9952afbc8b7365e5d47fb37008b270a7e0dee0c046c14c035f0b1a3f88c45ce262f895bc420be8dace52eda28c0
  • SSDEEP 12288:4CztCniVGFCL7EZTo7ZGSki2YmrgTPVrBJNQqI:4CpC5CL4ZkNGS+Yoqx7NQT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooku1bsratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2