Extracted

• • Target

    JaffaCakes118_419b8fbf8ca9417802fec54932b21f75

  • Size

    420KB

  • MD5

    419b8fbf8ca9417802fec54932b21f75

  • SHA1

    e8e5f943e65532a7317dae25894825cfb8187fdf

  • SHA256

    de5b63f4ffe84d34885e76b8f29147ab33106eeb4b3800d57c0e1edd23866fd8

  • SHA512

    5158408f1e32abe89be6e78f1baf8254293a2c3b160799b0813d471f5db31a8a0816c2431beb0467c007ed0e25567b263b551884e20ee2a5fd01807f46d313d0

  • SSDEEP

    6144:C37ZCkv/N2mK4vZKhrLslLT7yVKxpqjVyQBAHSUf29HwoXFaMRyGbTB5FY:C37ZCc24PmKxXQwft27jbTDi

  Score

  10^/10

  formbooku1bsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2