Extracted

• • Target

    e174a81d3a5acbb08094c63102f38e76_JaffaCakes118

  • Size

    513KB

  • MD5

    e174a81d3a5acbb08094c63102f38e76

  • SHA1

    a0c3be456bb4eeb5c76c7896df3ba511f0905fda

  • SHA256

    b676c82353948f50f7e978b317f1633903c5a03a99b659bcb0395109b05f6012

  • SHA512

    244df2d51138ba8832ec9109294d438cb986f46b10b94477443f8c723581c0f82d374d672234cc6f736a682304838b240d7ffcdb91124f1b7ac24a530b4570c3

  • SSDEEP

    12288:B1xd8PIcO+kOmZ2xd8PIcO+kOmZcIztkolugFnJ7:BdMk+kbUMk+kbcXobJ7

  Score

  10^/10

  defense_evasiondiscoverypersistenceformbookfrratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2