Extracted

• • Target
    cc38e3ac1ca97aefdaf92643c1dc68f3_JaffaCakes118
  • Size 414KB
  • SHA256 22542d1aef8c0987be0f91b90e4f70f372cc1b16ed67bbb1582798cac732f538
  • MD5 cc38e3ac1ca97aefdaf92643c1dc68f3
  • SHA1 3f80d544c9e3b789db490a13c86dc5cd61682bc2
  • SHA512 04c876e75e495e1dad18c06d669c2965feaa25d454fa54dc754091effc67c4704a78c10a53185b0cdb4e2cc3b5ca9ab6854632205539e6853dbd84e1b4f79235
  • SSDEEP 6144:w31JnqbGb0cd0yGdXeEW58hp9b5vwMVO5UWoU8F0:w3Hqb3meXe0loWkUl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypersistenceformbookpgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2