Extracted

• • Target

    c793aa3151a912ac2f8395472d580e02_JaffaCakes118

  • Size

    1.0MB

  • MD5

    c793aa3151a912ac2f8395472d580e02

  • SHA1

    3a57bb08ee72c170abf5baa6ebc2bf3c06242ba8

  • SHA256

    29559b48621146787d64cd953d655cd34f1b4a029c450d4364e2026e8a671982

  • SHA512

    733ddccda37f02e7e5d6c435348cc711819fde7efb3e3a60506e84d787a0d5049e1b822a368c6fa65433a14e026982efa418808b354ab27665e30c11c0dab561

  • SSDEEP

    12288:FjyBKuaUvheZI/hEpLrXtRSf6kXNYMGLYDXIE2tuyG24NGX2saLGPA5E6WtXSitJ:wpeZI/GBy6kd6L5E2dH

  Score

  10^/10

  formbookj7ediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2