Extracted

• • Target

    be89164ecb2619c73b8aa49503c87ab3_JaffaCakes118

  • Size

    405KB

  • MD5

    be89164ecb2619c73b8aa49503c87ab3

  • SHA1

    4527ba51a42f2e99a30fa14c0cbac17adb1a4c61

  • SHA256

    fe76d90027602729ed2e7d13c8db252f609f0c99b3c3bc263ac43df01ac93dbe

  • SHA512

    08e8f30f09d79978c49fbae930b305829f63b59655bccb07cc8fc2c7de7c32df2d013d82d1cd931670a0bd8984d08df36ac41186ad59f4a2a3521d6750d92f34

  • SSDEEP

    6144:nInzaVaiwTFpxzm23Kr389xVWoi6uvLruqd6hGZEOQWiqiwjq3ZZH9cDlYLW/Vfd:InzaVaiwo23M6u+qMhGZhxd1QzMTkR2

  Score

  10^/10

  formbookbftdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2