Extracted

• • Target

    3e07688e4591dc314aacba05ab9166f4_JaffaCakes118

  • Size

    842KB

  • MD5

    3e07688e4591dc314aacba05ab9166f4

  • SHA1

    3dec12b87aeb0311be975228d29d4314cf8c3cf8

  • SHA256

    3e8e7c9ebb8ae4bbb723e1974f176f8cb82ec0fb4e1890ee1f4feed08ae76058

  • SHA512

    469d672eb21727b6e8795bad8140a76fc221e05d01f611abebace3187d3ddbedbf7112d912f580b0c30176aef187ac3e60e8dfd6353f95aaa6ec8ba59baa633e

  • SSDEEP

    24576:eyB4jL+f3uCoFmyQYzan8qovytjC/xfL6+:Ia3TyXWCvytj0x

  Score

  10^/10

  formbookpu1idiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2