Extracted

• • Target

    JaffaCakes118_95fa1b0ecaaf1530a49fc9983aaf3e75

  • Size

    658KB

  • MD5

    95fa1b0ecaaf1530a49fc9983aaf3e75

  • SHA1

    50817e76ad62be263ed57337f0bdeb56d9cf89c4

  • SHA256

    4302ab0f740b3950f47a0cbd76e75681a6d3118ac97154450a2daf258fa70db5

  • SHA512

    0ecfcbde9d23dcb67823793f03f3488cb938414e7a7a77c0dcfd4d6b019b2c1ec4ebf6e8a54d606882b65479f5df0567f7ec12ede9fe51beb7e45912d2d01a87

  • SSDEEP

    12288:EGokEm1c6UrKyP5mRTsT52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMMMt:EGTEm1c3KychsT52MMMMMMMMMMMuMMMn

  Score

  10^/10

  formbookg8nidiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2