Extracted

• • Target

    2b58b674323df58dd616043e8891938b_JaffaCakes118

  • Size

    898KB

  • MD5

    2b58b674323df58dd616043e8891938b

  • SHA1

    cb1f2b71eebc7ecc10e631905dbdea373b8d27e2

  • SHA256

    7f654b1fb8cc24a97902e4a32291e182d42efdb378de4b96ba16b7af6ae5dd2a

  • SHA512

    f131295dc83dfa4fafcb9369e3621050c58e0e7c3e99464f05159903c133333e78565160932c17549fa7e905e444909f732d5a6f4561bf87e4a86df4b83dd0ff

  • SSDEEP

    12288:9StsF9+ht0DZNUpj7uTfK4apVKmdea/71SeLU7MW:9StsF2t0DZgj7MfK40KEd1H4r

  Score

  10^/10

  formbookhx321discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2