Extracted

• • Target
    29e6d44753147ed82b462a46155bf27f_JaffaCakes118
  • Size 421KB
  • SHA256 145880ed94e0db3cab65cb54db4728520f1ac5f95ff2b0dda2650233542dd706
  • MD5 29e6d44753147ed82b462a46155bf27f
  • SHA1 71eb92ae7e61a791e3fc2e502fbd756059c6afe8
  • SHA512 3bbfbee68ba8dafa2164a2d5cc9e66607f3901c48c774f2ee7d212364433ce6e75eadd95771bcaaee75c92fa9a23d8cc8bbfbbc436c176879fa53b5a6f282792
  • SSDEEP 6144:IS1dm0XmZxcY5gtCdG0tR3XdoHHgjMNncgHyJUirSoUj1Rrlp4dW+dTUs8l3e:XPRXmvNSCIi3XUHgQNcYyCVTctdTU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookajrratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2