Extracted

• • Target
    e9105c948c8e8f8f2869e8e12961cf9c_JaffaCakes118
  • Size 1.6MB
  • SHA256 20828cb2c7f6b1366beffd4b93946ad4d8e3e670a0f530e90bf93184c6cd46c7
  • MD5 e9105c948c8e8f8f2869e8e12961cf9c
  • SHA1 14fa84a3f670f76940ba5d5e6ed71a059d4dc6ed
  • SHA512 1b449a347d9493f01fdd371a6e62d0bb78f389447c5eb62ea39211e947d2555c7553d1ed3ac69d08823c93fad0f5cb623ce4583d1556c779ead5c732eb2b3265
  • SSDEEP 24576:SEzfWvW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+9:3DWOiec0ZO3EbrONQuiNB/e
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmyndratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2