Extracted

• • Target

    b8a6bff0de26505a8671135a34c21ff9_JaffaCakes118

  • Size

    739KB

  • MD5

    b8a6bff0de26505a8671135a34c21ff9

  • SHA1

    3da946ce135ebc855d27681a9baffb8204013ab7

  • SHA256

    ca928ee1114c01bf51f11b5200d0da9a823cd35cc4e616ddd3f44ddd3f3fcb56

  • SHA512

    9804648531b9bb9d9e4d3632b0f43dfd5fd5423a12571376900b7801a2b0f0e20be5bbef04ec76d59139f9a1df7dd162d784f63a4caea82746768d25578cbc13

  • SSDEEP

    12288:GtTk4E9YztD96v+vANmnhWvGY6sAL3+GHUKlbCOA0HK7znhyDBljJhqPTqCkUCM5:yYMhWjAryOWlyDJhqPTqXUg2JciMvo+k

  Score

  10^/10

  formbookodsediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2