Extracted

• • Target

    53c14ef13d4a6bd9ce56da43567ac0d9_JaffaCakes118

  • Size

    921KB

  • MD5

    53c14ef13d4a6bd9ce56da43567ac0d9

  • SHA1

    51b6813d1f8d33bef00201ec5ae88cd1dba4e338

  • SHA256

    94cbf229daa81e3a734f6199a8ab4d5fede7f71cdee579db4bb54369d531410b

  • SHA512

    fe9dd981e04171e94a2f51db1081590238496723086176fe2953a325c5021fc790f0cb2653650ed81f2764ca089e5ec7d97e146952673355d94490a443d059cb

  • SSDEEP

    12288:1zADtztyiNaTCSFSsFjdo9FecUZ+7/fosnyXWHMVYRlHK7zjzKbojReF:qD7yiN8tFSsFm3btCCxRo7KboM

  Score

  10^/10

  formbookvd9ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2