Extracted

• • Target

    f3becd80be8779dfeb8ca5791f7ffb86_JaffaCakes118

  • Size

    414KB

  • MD5

    f3becd80be8779dfeb8ca5791f7ffb86

  • SHA1

    91f03335ff735cef93edafc6748d354d08eabe87

  • SHA256

    44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618

  • SHA512

    f508be9b45170e7669c69ab6ec4849ddb318ee8d9a0d3ffc906197747de67b94d4c32b8aecb383fee6ce49d7e364a07743c8e3a7ed6e91132219633d65661abb

  • SSDEEP

    12288:5D+5/QYSTtPaFx06kmDfAbqt2gqZhXmpgZPa:AX8abxkml9D

  Score

  10^/10

  formbookkvszdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2