Extracted

• • Target

    957014bc66c96533ca3cf65a5b355038_JaffaCakes118

  • Size

    732KB

  • MD5

    957014bc66c96533ca3cf65a5b355038

  • SHA1

    cedbfdb6bd9d4ee9397d2fe0bfab563b01c9ba2a

  • SHA256

    fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b

  • SHA512

    dd3a42758775b0b8cbd53f89dd23d99ae56a76fa4c13abae3e307c5209ec1edf5a070fddafa9bf6174a0243089bab53fe0c9988ae4b4af2f72f42a2d4e089314

  • SSDEEP

    12288:nX6Orlv+6cJ/QlI2eUBvV+klwuimKb0aw1xcA6i5zDJEkcYv2tasGHW:X6O5Lg/XUB9+jPsxJ6i5zDeyutasoW

  Score

  10^/10

  formbookbf3discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2