Extracted

• • Target

    f817bc5a13f0f7ffe8652f86dc0ce55f_JaffaCakes118

  • Size

    964KB

  • MD5

    f817bc5a13f0f7ffe8652f86dc0ce55f

  • SHA1

    0f2d30796f411da74a3af083966bad88f4a3a326

  • SHA256

    6d4e4528a1cb3af656e84e74dab6731c2d80f2e57f95ca865ba3a0628207a673

  • SHA512

    5d09e4adcdf7a2a73972433b89021e702e08882ada4a536fbdb92c8fa492193822fcd8655003a2dfdf38840ebdba065b9f12cb6a3df5deab5ca2dc6c9fa533c2

  • SSDEEP

    12288:q+6L7SIHNcIPaYJPaSiMae7TT4JwH/CW4yaWJSt:qZXbtc8aYJySiiPkSfC+f

  Score

  10^/10

  discoveryformbookkbcratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2