Extracted

• • Target

    9ec16b6ca90830f0b441ea3e8165ac6f_JaffaCakes118

  • Size

    814KB

  • MD5

    9ec16b6ca90830f0b441ea3e8165ac6f

  • SHA1

    fc6430b311fcc6176fa5b1cb00f5a173c88c7556

  • SHA256

    31484ef741b768334de711e353731bd89c67711df613b4e175f1205531a53c00

  • SHA512

    0f7e2ed8fb9265466e9de80d0683047628b58624eaa9dd261960c410eea8c6a6e04832f739461659401dec0700521967c210eb7c1be5472c8042f838a5b7e8ad

  • SSDEEP

    12288:vb8bzclUwpdXd04XzCdgfu0JvTkgY05XSn+huL4dxUFxaQOA5i+87QxsBop0wv:vgbeNUgfLxAPeCn+hu3aTA5i+87QxsC

  Score

  10^/10

  formbookfw3ddiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2