Extracted

• • Target

    e300b0ea04a1c33f7b0ca2a924632d3c_JaffaCakes118

  • Size

    365KB

  • MD5

    e300b0ea04a1c33f7b0ca2a924632d3c

  • SHA1

    47ec6138765a54036ce46ddb900d4ceccfe6d698

  • SHA256

    ec42d1761aba72e3789f1d11e744c46394c2929dfef85c8d6297d37a89057b83

  • SHA512

    f746ea33cb60e2e811a8ecfcd62e3ca0f3073e67c895bb81c0a18eb3b30b19f73da6bd4dee9c303034763001e8b1645b7e12959950cacff3279a706614b72eac

  • SSDEEP

    6144:hBplqXThHWJohGUzxQPlmzGhfeF/ohaNuuH1ay951GfWkP3yd+1rH8zGlzWdlJvE:FlNJoMUmPlmzGhm50oFTUWkv/HQX6

  Score

  10^/10

  formbooks8ydiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2