Extracted

• • Target

    ca3bf59d8a50c50129515551c389f6d8_JaffaCakes118

  • Size

    736KB

  • MD5

    ca3bf59d8a50c50129515551c389f6d8

  • SHA1

    a0db5fb809772e7886672568db1329d75c857b23

  • SHA256

    318d039e63460267fa92391159395a8d82f58e98c4c88831eb20780e485d81b3

  • SHA512

    87e26b31b904d7a1ac418ab945fb8311ebbc8f9183b885deb2b253b3db1b49b7db6f4f542c50b9b3ee54dcdc5834a42c7e6623e0d56a43bf5ae37cfa3b605776

  • SSDEEP

    12288:9watuz+EFVnfzjreMmJzkg0nYvJS15NLgw1g+esTCmu:9watipF7mJIg0A01HLJP2m

  Score

  10^/10

  formbookl5bootkitdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2