Extracted

• • Target

    c57658ef781e0f31e6539263bb87c7fc_JaffaCakes118

  • Size

    555KB

  • MD5

    c57658ef781e0f31e6539263bb87c7fc

  • SHA1

    4a8902bdbfe4d490aac56b9962caec5598e5604c

  • SHA256

    a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7

  • SHA512

    637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922

  • SSDEEP

    12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F

  Score

  10^/10

  formbookbftdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2