Extracted

• • Target

    d7dd59c45d9c7d647d28b83412e9e1bb_JaffaCakes118

  • Size

    397KB

  • MD5

    d7dd59c45d9c7d647d28b83412e9e1bb

  • SHA1

    1bfd4f114eb6e9cad55206056fecf9da0cba7bdc

  • SHA256

    939ca5032b5fc17d00bb9be7b7cb4bef70691a76ceebf9777b58e9e9845a05d6

  • SHA512

    1c9772f686d149d5e19ace0779681c3f64db051b43db559b74b3e05013e8cc71ef9451df3016f87a54654c8ea3c63498d9f3f3987b0e63f3f71a940521689172

  • SSDEEP

    6144:Di3fBD/vecMMW3b9A53IvHlouxcAG42uZB:ONPkEiHegnT

  Score

  10^/10

  formbookh321defense_evasiondiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2