Extracted

• • Target

    82ad6d4689e3490835817606958cf5fa_JaffaCakes118

  • Size

    490KB

  • MD5

    82ad6d4689e3490835817606958cf5fa

  • SHA1

    95040b9910f5d2a54323e1d88cfbff152b22f87d

  • SHA256

    f1e9550490c3ff70c5a36623d87419084d07fe0d8f6590cc411aa15d5c9d769b

  • SHA512

    818dd1930f6728b9050692588e344e2a3fdae5f0ba5fe80b7c39a6181f679cfa9ea41450ec30dec6c9a5440d74b2fd19d0a239ab77a986537661e82035082ce8

  • SSDEEP

    12288:P1clJL7+GuvYWnePtWZ80dLAtlr4BP6ahH5ehx3q/lgt:P1cfNuvz805g4P6Aoh

  Score

  10^/10

  formbookvd9ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2