Extracted

• • Target

    234a9557e370d3d750070b64808b0426_JaffaCakes118

  • Size

    734KB

  • MD5

    234a9557e370d3d750070b64808b0426

  • SHA1

    5361da7e6f3d85285048b3a82f33f0d74309dcfd

  • SHA256

    7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72

  • SHA512

    3784a8986614286d56e3df35a30d7cae6ccc96d841f694e087296cca2d5e4bba25da37189cec36b7a6cb87f4d97cb47ffd17a004b9d5faeee128e6dd9dbba60f

  • SSDEEP

    12288:MXqv2J82iNeHK7zEIT4IVQG//+Vv2lIewZPVV8b8b9c9GZrZ4eB5eUZ7/:MXqv31b5yGzl32PVCbK9c9GlCeB5eUZ7

  Score

  10^/10

  formbookiesmdiscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2