Extracted

• • Target

    f31552ce9f7c855638e31f2769860aad_JaffaCakes118

  • Size

    744KB

  • MD5

    f31552ce9f7c855638e31f2769860aad

  • SHA1

    5b10b3c2bcba091aee5122e6c0ebf43bae9201a4

  • SHA256

    9ea0d28239b54bf88e8c160548d590cb517fa415dc8f4425a3ddc36fd4ce038a

  • SHA512

    e14aef64726213f7f66da0dd435935032d630496ecf3887ec7016490fed909203f0d9ffa5b19aed7f46a2afc64ab1d5191aee15a377a4caab2fdf49d37c4d013

  • SSDEEP

    12288:g+WhWEyIu8oWJsXXeo7Z/FCWnY/my3Of9OFpYSiYAH:gIRItoWJsXdyPR3OFOvYQy

  Score

  10^/10

  formbookch35discoverypersistenceratspywarestealertrojandefense_evasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2