Extracted

• • Target

    c4df520118d965fb2ab0bde1dcc09ff3_JaffaCakes118

  • Size

    730KB

  • MD5

    c4df520118d965fb2ab0bde1dcc09ff3

  • SHA1

    ef4144775c594a5b327c07c303a05d80a02be2a6

  • SHA256

    2e155653e55de265cfccc7878ca28f97a81a5aaa53ce70220d2480987dbe210b

  • SHA512

    c556c0794fd1b8a7dcedce0e6c865e9a98314a262b982558d7e1af9872968f2173c2f73e7942d77210fbbcf43ba26902ad5658bb14d3b1b26bb80c895b5b4080

  • SSDEEP

    12288:/OMm3F8MGhjSyUo7sIcnfDETcX8jf0NLOQL8Iunvmqe:3m1rGhj09IcfATw8jfMLXYnvml

  Score

  10^/10

  formbookch52credential_accessdiscoverypersistenceratspywarestealertrojandefense_evasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2