Extracted

• • Target

    e8df56933dc6b29f0a0aeebb682b6ca2_JaffaCakes118

  • Size

    1.1MB

  • MD5

    e8df56933dc6b29f0a0aeebb682b6ca2

  • SHA1

    e812c2bb3b17466886c947bbf4859685d9931f91

  • SHA256

    5fe669ecbc820aa52d3fb572b96b7c1cadad169da50cf1a67d4268cd917b041e

  • SHA512

    5a0baabb1d2c3fd643a04394aefead9cc5360fbd0864e6f6fcc3edbcc042b917dfc3a323bb6d31d81999a40d61f22dbe4efdb0e80b7c01bba5c5a7f154650561

  • SSDEEP

    12288:CC9lmw2iN4yXCyWYXjFofiV6OaQNB/76NQAQbUL6Njg5WHo+b7:d1PXCyLFoKUQNB/qKbUL6Nmwo+X

  Score

  10^/10

  formbookvd9ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2