Extracted

• • Target

    4b21b233b4fb9b116477fb24cdd8e376_JaffaCakes118

  • Size

    463KB

  • MD5

    4b21b233b4fb9b116477fb24cdd8e376

  • SHA1

    8e88400d1292aac8462b0413e039fd16a95112cd

  • SHA256

    2f074d479236e1b4b36733f1e071d6c053a135025cbc62ccc233776b23604390

  • SHA512

    a0d1871e551fc1cd45e7bc8e05841a79aa8e59743425a56a66ee3bb8e68c55dcaa395bd33f5a5eb4629f97c80a428055b966ad0af1c471742764c79b6de3e19e

  • SSDEEP

    6144:R5iXq4NYHjLS1hxsvAwC0LhvBb4f5YghFZByCgWfF5fJloa:2x2HUhuvj8fBZBzv5fo

  Score

  10^/10

  formbooka43defense_evasiondiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • System Binary Proxy Execution: InstallUtil

    Abuse InstallUtil to proxy execution of malicious code.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2