Extracted

• • Target

    c1b83daeb8757d575a940c65bccb0d1b_JaffaCakes118

  • Size

    955KB

  • MD5

    c1b83daeb8757d575a940c65bccb0d1b

  • SHA1

    857e57fbce938345d8baea856ce232179627e995

  • SHA256

    c1191a2395a4bcd7c12c63ed628be5c3df1ab0d0b51d46932716fb0c917c0dde

  • SHA512

    8a8f80c1de2c2fed85091160b1c6c3912b43ed5627d05abb7a8a713a41bf1edfac06e8bd6023925a82b56eafa5340ed4880705588c5e6b405bf70e6cd7b8c3e9

  • SSDEEP

    12288:/6FSCKAIMqmB0a08IEvs81TMe1vJrW5/n8T8S/5uEJ52:a1fI00z8IR81Tdx+8oE3J

  Score

  10^/10

  formbookmdidiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2