Extracted

• • Target

    50803379c862897b497e96fb6f5b3f48_JaffaCakes118

  • Size

    709KB

  • MD5

    50803379c862897b497e96fb6f5b3f48

  • SHA1

    0ca45c28c48d06a9349ac1edd3f2d0430d254768

  • SHA256

    b2ed4938e2e41c6015a953684f2e3a271044a0f7ede57e202e0026d492bf7c5a

  • SHA512

    420561ca82648f81ffd92175454b72d756eadd88c42c2809868da7e17af479e049b9b3283e91017dda0297a83c6c706f5dc29825b75c7ac71aa5797bc32f4f9c

  • SSDEEP

    12288:w1kx0ygplQ/7F3pAklbX5cPLxGOOv3KkDNx0yna:w6x0ygpu/7RpAkp+z7Ov3dhx0ya

  Score

  10^/10

  formbookch48persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2