Extracted

• • Target
    ca04c158a9dd8788d96884e6eb11a21b_JaffaCakes118
  • Size 729KB
  • SHA256 f083c960cd2083e99fce5c4546a4732b63500fac38c201fd90d73d6d762204ab
  • MD5 ca04c158a9dd8788d96884e6eb11a21b
  • SHA1 27e948bb6d7528e8424c4407cc2723341be80b9c
  • SHA512 88900768c5377b0e54e49430971a92e764cd45690bd7e4650560650aa18635669660ef202adfbdb18ee0f3822cac1241f78b61b8fa90f26bd0822721fb14ea12
  • SSDEEP 12288:UxT5FTcrQ3yNB9U+p+ll2ktCdM8xeDraRe1GfU24:KTnoPIXtSD4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhs3hevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2