Extracted

• • Target
    863bf0dfa1169706f566c070a1e11256_JaffaCakes118
  • Size 395KB
  • SHA256 a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b
  • MD5 863bf0dfa1169706f566c070a1e11256
  • SHA1 77175726680e40eeefdad0578a1d3377486d9fff
  • SHA512 21aef52bb4b5ed66c632c0ca55e156b95dd5bf2715599880fb0b5ffea523fca0b82739cf2617095336c332664ab8dcdd64fa910d3bae64c9f384767709720ada
  • SSDEEP 12288:nanOzOlC9Am80quPgdBHh/FOPfe+VYRVORkG:lqltm80qigrHxFGVYbi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookc232ratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $APPDATA/for/page_1/13.opends60.dll
  • Size 51B
  • SHA256 e3d2cfcd73d4f98f610173031b36e4ef77771c50bdb3ec3c8b4f2734b52a73c3
  • MD5 f04aa19e6a25638e61867d3495058e79
  • SHA1 f06f9e02611cdd1cf3d960897c262f528d2bfc32
  • SHA512 7037e51cc7e02be051e16c70ac65c10a6943640a92e91860550f3115220fb2ff78340427a4c796b411dccd803eaafc6fd5cf179432d206445fc819bd2f3df667
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
  • Size 36KB
  • SHA256 46b1a81f5ebb43404ac7229d14593d5f47930c8fc3fb5279ac5402507f7ea7b3
  • MD5 6ad1c32675ecd48f15535e4a0e474e28
  • SHA1 2d9b200ea1d9fb6442f21bb5441072bd4b9d1968
  • SHA512 8a425760aa2e7bbe286b2322d2413eaee42d7e386448050c46f61c461481407800ed2b5bd19beee77dd74fcb30e496d36c303d0845e1ee138babf6f483da1659
  • SSDEEP 384:EW2BCQspyJi6d0XsNGIEP/06V78FIISqa4ld2Cxs+NHsRo8CWewMW:fBqJbS8N7IIlaAs+NHsKe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
  • MD5 0063d48afe5a0cdc02833145667b6641
  • SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
  • SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
  • SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
  • MD5 6e64e5d5f9498058a300b26b8741d9d5
  • SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
  • SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
  • SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral10behavioral9
• • Target
    $TEMP/2006/35.opends60.dll
  • Size 57B
  • SHA256 99e399e564c46308a2ec22a427f5338433a820c09ff559c8f6488be9199ed1ad
  • MD5 b330e04d27f2b76246c9401bb9df8405
  • SHA1 fea5928cf1704d14ee717bb703c65aedfb194751
  • SHA512 b07555fa3fb5e11e91583c28922f5a59f09e0cc8244b3bc5e62cfc231cd4a4da080f0653d404ca9a8ab332f61e393ed17235858e84dca0578f8ae51e9b5f30a9
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral11behavioral12
• • Target
    $TEMP/SitulaCystocele.dll
  • Size 50KB
  • SHA256 18e86106e60613594527c85fe6c97287fc8c3715181a62cb2b4d2258c210b6c8
  • MD5 de3f3ceccff80b3b0cc7e8cc58357b70
  • SHA1 701387d5e62903e114f4bdf59cd4f89cc6b2ad4e
  • SHA512 ad16ea6af2200f7f8a8c0fd0cc1fe5c935942a8789ce057818499b1a51865bb4a0b39a4091f84a2652d2c6ea7569e3829dd5b3043b2d44083a597f3954c2c6db
  • SSDEEP 1536:5EOuTAjdpOExDJANAB/qepudoVoD3Qu3IEN:5yA/DJ3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookc232persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral13behavioral14
• • Target
    $TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
  • Size 40KB
  • SHA256 1bf2270bfa6bafe29329f9d84c5f8856b57c84af6f3ed05027cebc4f767d07ef
  • MD5 b59ec4aa8cc4eeb16e5567c085d5d677
  • SHA1 7c2442b35816e0517648a390f106910ae960f7bf
  • SHA512 719d127a378fb16772c5a6c4b6ea6225a27ad4cd2a0d84e237faaa7a1a4e63cdd869ad2cf04b57268e393f709adea2a8aa83c6a640111d93fd2071ebdac7a470
  • SSDEEP 768:MzE7orC6TyNqZ7t7Ahh5E4C6FHYm6d985dgn49kjkGnUOhBpEdpb:tkTym7t7Ahh93+dqgbjXUOhBpeb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15behavioral16
• • Target
    $TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
  • Size 3KB
  • SHA256 7d5e33d5b52f33c807c8c00273a2ade316de42012d7b915988731440194a6bd3
  • MD5 9e44dec6dec0a8c055a6a48d3ee29052
  • SHA1 7143370f696522feb81fe920798d5792b763a561
  • SHA512 94c20ac41e1e9a41d02361a8273b9c86167520f0eabb545dd7e174d2d0f53576ce374f5cd34029bb1f13c28d5cde92e406b0708d2e8ace73956749e1b8970719
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral17behavioral18
• • Target
    $TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
  • Size 22KB
  • SHA256 dbc470b89daeb73f6809b4df70fc0078d14fc8bc6b77a07ba479f93fa72afee8
  • MD5 d98672a1094da398dd2caad207d4d188
  • SHA1 a510b3394bb8f5bd2bff086dd5a874a9af762e77
  • SHA512 978af83abb1dfcd78e4a1074d15eeeb1322fd1261c4071623b3c6a0d05a470ab85afeaaf7eb244c3ce106875e23f5c0487daa1d523460a8f8283d0a1b5f08279
  • SSDEEP 384:4WswcEWTVjEBNRTDJp6Np1Od8zUXt5tqdPJbUOwjAw7j1/Og:8lVqTDJp+p1OaYt5tmbUOwj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19behavioral20
• • Target
    $TEMP/mode/Thumbs.db/intern/PermCalc.exe
  • Size 28KB
  • SHA256 57f248daa64d83c215189a3d38b9692f93125273ee046328febe33e69df01ded
  • MD5 c2efc9fcbbf2d6952110fea17841b71e
  • SHA1 4860494e79e88beacb0155584056699adb073f44
  • SHA512 5aa7033b6b9de91c309554b354d47d63c08d15d4d5ebe4ac6e98e059873c74149c869dea731a2754ca31dee526f27221cd210555693e5f6886cc26d271f39ae0
  • SSDEEP 384:xL8f6BoGrFTth3SAUnZV7OKAyXSKglWYbW:98iBoGxtSHqKgB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21behavioral22
• • Target
    $TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
  • Size 37KB
  • SHA256 fcba2ff7bce5ba6c0a5188cfde82009c7acd6b14cb14ce390ab5a49773a425b4
  • MD5 6db03aa5dfe458e7a4e21d9688d3dcd6
  • SHA1 256e539c011697a8983c8a609e21cdedd4d59ecc
  • SHA512 0a5e16a993b3c2afcc8326607046ca509d2ac63682f99a149cd539e474ed6062f54b5c6b02bb8272c271ca0bccb48c08b75d18cb4ec5350d99ec885e25de8ecd
  • SSDEEP 768:r5Eiu+UuJwO3YkHr05FLsHNqW/hks6qrJ/Ejv7Mbk6huUc9zhX:fuDuyO3YiIAHNqW/ms6qrJEv7Mbk5UcP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23behavioral24