Extracted

• • Target

    a11723be474379dc80852dfeb99d2b4c_JaffaCakes118

  • Size

    1000KB

  • MD5

    a11723be474379dc80852dfeb99d2b4c

  • SHA1

    918834984c6d13577625ae3b93d6207493f7ee15

  • SHA256

    d8ae48ff83b31d072c1a9d988660e2a0be125aa9373a4adb1dd807d0fea4ebe5

  • SHA512

    24d7c9bfe3cdc67c36b5eeabd26e30a7f894a906fb475ff9996b86994e661bb10492d2c0c8da86aa4f51f1e4d1a02ee33400d24f70a27fb4bad9d07a3bb07036

  • SSDEEP

    6144:XJ8hllsOBcUsBIynzr9dqrZUydTslCKhX6X01GvNBpTovheTS7orb36TRJeFE2J:ib9K/nzglTkNbGbpdrn3QQS2s

  Score

  10^/10

  formbookn7akdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2