Extracted

• • Target

    JaffaCakes118_187fda2b830429934ff2d59c014f05098bfb323d639be258f075efa4309f5c0f

  • Size

    265KB

  • MD5

    a0a1f5ff78c714b094a5fb386e02a7a3

  • SHA1

    10fd01e713a5b96d19fd636e646f231bdb059bf1

  • SHA256

    187fda2b830429934ff2d59c014f05098bfb323d639be258f075efa4309f5c0f

  • SHA512

    6db4734f3b1f13f4ad87dd3b604a8c6b37698e7b788604d53fd42a3cf0af9155c96f54ce5d2651ba2f905a385eddf0c57284bda0078bba4ad5f71adde9e05fe2

  • SSDEEP

    6144:xNeZBEmUT5ohIP1DT1SDLiXoina7ZnkOnIhB:xN+BI5yWHOiXlKkHB

  Score

  10^/10

  formbookfkkudiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    xscfbjx.exe

  • Size

    74KB

  • MD5

    08b101029a510d1467056305f8bda101

  • SHA1

    938d534e3584b132ece92f01e0089304b9587803

  • SHA256

    3d897c1632a6234082cafef209af7ddb9f91a0af33b03e6d004e153a54d622c0

  • SHA512

    631cc7c7a08b9492661983200ecc9b96c2d958d756808ed8b5b431a1a29ec92d360866c41c5d8307a3d185bcdedb4e66d661ec812d47d1ae057013a8cbc0ccbd

  • SSDEEP

    1536:xjLDJzMtIyKhdKim2R44oQWUs5PRoMLEEpt8vTlJssWXcd5CM+ea:xmIyKhwxQWUs5PRoMLBylh5CMXa

  Score

  10^/10

  formbookfkkudiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4