Extracted

• • Target

    a412e0810a9f85881db7510435c6c07e_JaffaCakes118

  • Size

    634KB

  • MD5

    a412e0810a9f85881db7510435c6c07e

  • SHA1

    e04c86f4288a2d2d07fb184e02412df2d7169cad

  • SHA256

    1a5f34e73e2e79751dd26d14360430c28bcc98a02c41a1e063ba6f88de477020

  • SHA512

    1632ec57b79a2323f59d2b6b29b716722240ada5e29edc17efe649728ce11722f096d3bcf8bc7ecc09a133794c4685081797368c8fd85276fc879ca3a2abc69c

  • SSDEEP

    12288:Ob6ah8sqonj0q4i08FuSb7oUYduW/LwmUuNfIy4lE0RReMysGd:5sj0qd0mHbkU+uILwy2mzsG

  Score

  10^/10

  formbookh331persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2