Extracted

• • Target

    JaffaCakes118_28f253dd70ec114954cb9720bc2e833b

  • Size

    524KB

  • MD5

    28f253dd70ec114954cb9720bc2e833b

  • SHA1

    89bbf2aad3258e47a338d0344509fd051cac842c

  • SHA256

    51b54616de868dfaa1addcc28e0ca99f66a061de672858c2cdccafcce04aa335

  • SHA512

    15b8d8afd9eaf879dd2587dd923b481c7de71653b49f7c0adb91e253d276a92661721bf552c18ec5243e1f10078f8d09b5d2e1bacbc0f5f364cf4a8d3857848c

  • SSDEEP

    12288:AUi2iNekn+gWfltKCgfNQoJNu7OcJeDWh5lgCFI:AUi1Qk1Wn6aNYDW9

  Score

  10^/10

  formbookoy1ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2