Extracted

• • Target

    faa3989b7d9f646b33c0766e961588d7_JaffaCakes118

  • Size

    716KB

  • MD5

    faa3989b7d9f646b33c0766e961588d7

  • SHA1

    8cf06215e8fcc8c924fff53932c12a7ba8e51f18

  • SHA256

    85b16ccd1d3e8c27eab6c704db4c5d66b0bf92b425b509d93b5d7a97e6ced242

  • SHA512

    069ecbe76e92b8af5380a86b6297a39cc2e8378079083a620fc423cfb201dcb52a1a57b30c09c605dfc3e91a36b0fc0e883e82c0282863e17ed2250ccaec4779

  • SSDEEP

    12288:8LAW48eZZjNOahLCgtQTaiqy1fbRAxegZ+esTCm:8L3eZjNOaBcTCKfbmxA2m

  Score

  10^/10

  bootkitdiscoverypersistenceformbooka1ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2