Extracted

• • Target

    JaffaCakes118_8e3ffb0282c016ce500a81a4e7a5f13e

  • Size

    506KB

  • MD5

    8e3ffb0282c016ce500a81a4e7a5f13e

  • SHA1

    3f0acf30be8406bc451bf43ad5a704c066bd89b5

  • SHA256

    370b7d8656ddabeb6669b24da32cd047ebbd977efce6047bd26e8326a98c768e

  • SHA512

    ea9cf7dd7afdab45021e88d3f258d6d38d91b9952afbc8b7365e5d47fb37008b270a7e0dee0c046c14c035f0b1a3f88c45ce262f895bc420be8dace52eda28c0

  • SSDEEP

    12288:4CztCniVGFCL7EZTo7ZGSki2YmrgTPVrBJNQqI:4CpC5CL4ZkNGS+Yoqx7NQT

  Score

  10^/10

  formbooku1bsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2