Extracted

• • Target

    5c1bbc3ef13f11786c71d2b038ffac9d_JaffaCakes118

  • Size

    857KB

  • MD5

    5c1bbc3ef13f11786c71d2b038ffac9d

  • SHA1

    782901838bef058386683429bde3f10926f226da

  • SHA256

    a925156696d4acad19f9063afbd082d0fccbcca820e262a91e730077705ab2a5

  • SHA512

    e93cf0d6a4ec73b75e28189331fd6b8cc5b5d65706725ff35418727429e50e9f292286e136edc289afd31e585d5f6b436a125a9276dc0659b8987dd9ab6b7ce4

  • SSDEEP

    12288:XkESTi3VrUwuW1ScWxRL7QZwupHHRi//ASc9VTiukEH:XkESTi3tUrWpWjQyiKDc9VTiukEH

  Score

  10^/10

  formbookch140persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2