Extracted

• • Target

    85c3d336415e2d1d331b6565559d475b_JaffaCakes118

  • Size

    676KB

  • MD5

    85c3d336415e2d1d331b6565559d475b

  • SHA1

    f117eb6b482560f7db100f6bc2a5d97c983a1506

  • SHA256

    da111408d9dccb99b2c429d535ca55f6e970d911da4c24553e75d02fe9c00489

  • SHA512

    25061663551ac20347d2263fdbb21f4c79f51c30623938bd02179dbb778291646423430c42d2a23367dd06f226ae590cf87f238699f312c5abb1bade22bfdd76

  • SSDEEP

    12288:8zmWSemlxC2WQXoyfNb2tALwvogLDiD/PkVCAkJca:8edl0YhvLwvo+mccJca

  Score

  10^/10

  formbookk8bratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2