Extracted

• • Target

    85641d2dfcdec2026c1c861488f86c1f_JaffaCakes118

  • Size

    766KB

  • MD5

    85641d2dfcdec2026c1c861488f86c1f

  • SHA1

    a10e141f74d3eb09b7dd554299bd23f0666ce3bb

  • SHA256

    8f493a908950607b487e105caa9b4e6f835d36063bcb61d19f450fb78a6db2af

  • SHA512

    93cf4c0d23d06bce8a37c15105ee4bed0e5e81f42bfb0a4f07c0325a1bbb6f524904d227f7ecbbd4020f2b3c59a5ee4362449836a98ce355f6c5c26c5283a574

  • SSDEEP

    12288:r8u5zkvyBLnFGP+Inlb8uYhkOH7ywD0Pu0sIPWfZ4OU8I2vXSJ:wsk4XIlb853LUHFrOSJ

  Score

  10^/10

  discoveryformbookglgdagilenetratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2