Extracted

• • Target

    635d7bfbe86119367a370eedabea2956_JaffaCakes118

  • Size

    761KB

  • MD5

    635d7bfbe86119367a370eedabea2956

  • SHA1

    c79e49a9c67d4bdbf3932c0d10230e1d14a28c25

  • SHA256

    fa1836a4fb3ed7229baa120f142e09c911d657e52e648dcb7412d49bd5833c30

  • SHA512

    4151ec961b9f49266d209b738b361dd2cb7c27cd61d7239e3958f59bea83b7465ee6a15b7159f4161783ec2f1e423ad8236603ab2ab958aca59ef45f4105dfb9

  • SSDEEP

    12288:h/0K2iNeHK7z0wSgjU2bcfoLWn2jiW1fe3Cawu7rCbYtpHmlDEvjVxKEljwH:h/b1boabSn4Sg2R+EvjHj2

  Score

  10^/10

  formbookvd9ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2