Extracted

• • Target

    eddd6ccb6801986267e55fc7a676aeb4_JaffaCakes118

  • Size

    814KB

  • MD5

    eddd6ccb6801986267e55fc7a676aeb4

  • SHA1

    a0b02e09425f5a21b0936d9de18703a7b2e858a5

  • SHA256

    6cb226cb2bc243d2b6b0421624a03ef846377b4527df1bc908b76f7b2a871f6d

  • SHA512

    5da7b04d9d61405a2420140455a9f91c5ef7ac6866eb1f15ca2641a965f4d708a50a5c38f5704ae5cc9e0303d3f5eb7933fa527df35e0966f82a12458b69cffb

  • SSDEEP

    12288:e+WhWEyIulu5kghlYyUyY0WoXf+WMyzVodUqGHXoqYH6N79/v5kgMZ:eIRIj5kghmyvffAy2GV4PaN79/v5kgw

  Score

  10^/10

  formbookch36credential_accessdiscoverypersistenceratspywarestealertrojandefense_evasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2