Extracted

• • Target

    9b316c1286cf6a10bf2447c128a76b46_JaffaCakes118

  • Size

    1.1MB

  • MD5

    9b316c1286cf6a10bf2447c128a76b46

  • SHA1

    38940f6ab390ec2006693883bf5585a7ec38c0c6

  • SHA256

    855dd7cf56397cb61245d06f6ed38576c71826737101275f66167986e602036f

  • SHA512

    2023e376d2f311a5cfe1424654ecc16fb75b6003b488f265292abaa056d0e811a76dd8dc09533ab273f5d5e8878e2c5d552b3bcd89eb0363f95126fb7c93dc33

  • SSDEEP

    12288:v/5pbb50EvcBQ3Tp4/IH3fjWqqhh8BAPg6OO3jTruN/YlRxsCplsj9lj/P61:v/5d5ABQ3TbH3fdqXP+O3jTruN/

  Score

  10^/10

  formbookodsediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2