Extracted

• • Target

    b7d81877eeba60cdaee88287d4dfc1a7_JaffaCakes118

  • Size

    1.5MB

  • MD5

    b7d81877eeba60cdaee88287d4dfc1a7

  • SHA1

    5c7a31f06e48760e3da5900b8bc8e5d2088933e5

  • SHA256

    8eb59f34b6e1c465b4b3c45402ed8d59fc136f024fe97d0cdf94f3c22dc20cb0

  • SHA512

    2dd5843889df3f3abbf93d2eddc43f2480be2eb16a549eeadd0f83df358248dbee593240206423321f5bae2b1eb94c7e4c62721cdd956dac89a60bb099fa8def

  • SSDEEP

    12288:+71CB0/uBEPbhrhi6l+jd7d/hiBnaLHgwBKanOLoejK9ufY/Zd8wzQ6H+Uy1Susj:CeGN1sjknKrBbOLoeUuQZOFZZS5R0

  Score

  10^/10

  formbookxgmidiscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2