Extracted

• • Target

    4fbb3e8426667c8587ac55683ff218a7_JaffaCakes118

  • Size

    853KB

  • MD5

    4fbb3e8426667c8587ac55683ff218a7

  • SHA1

    976da9e5a2f99ccbfc8294abc905bad48dad9f79

  • SHA256

    3483cc6eba3064bdf286495937743beb05a6bd065078b3dbea8c77880c6fca3c

  • SHA512

    e3329a539583ddf4c4062efb862e71775d586b1d3d28750a1c8dad2dc59ef6e89da35c8db097bd825614c1e9019a233fdb32fc9e7d53797d748c68fad43ba5ca

  • SSDEEP

    24576:9r6b0wFVMNjQB2f3CmLW19ZWZ5RqcxQsw46w:9r6YwFShQCD/qcxXN6w

  Score

  10^/10

  formbookodsediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2