Extracted

• • Target

    0c3c3c868a9ee2d1c6c14f9fafd757a1_JaffaCakes118

  • Size

    946KB

  • MD5

    0c3c3c868a9ee2d1c6c14f9fafd757a1

  • SHA1

    816b112e6027f9d1caec76f78231bd24f6185094

  • SHA256

    df6ade5c4e7c4f0e82aca32d744b6f8762d2dd82a98b7bda97e42748d488a661

  • SHA512

    e71f53fa6a4b2d0c36b7b9d110988e47c11bee51ed33dfbcb1368adc34f10a8e17112cd286f88da637075dc37e1946151edbebb20012dedbb2487e6f18848f2c

  • SSDEEP

    24576:B2wFJMNjRquEyu6nXj4UCmPUUcQfbhvj5CxRT:UwFehkuEGnTVJs9qJ

  Score

  10^/10

  formbookvd9ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2