Extracted

• • Target

    JaffaCakes118_9b288f1ed4b43253489dbd03b8902445

  • Size

    847KB

  • MD5

    9b288f1ed4b43253489dbd03b8902445

  • SHA1

    1aaaf8dcc605ec1ce72bbadea6655ce26eb31517

  • SHA256

    fe68fa8aa8522badacc0c97554cd4a1b8d466dd16dc61b86542e799db0d1f7ae

  • SHA512

    e22b548195c3528869d0f67b0036fab1f95c6f74e70a8b77b829822487916e99c5fe12b49635856c667ee78a459163dbdb899c0833d9c8502246180b74096db1

  • SSDEEP

    12288:TaOZoS4FJfBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLmfKWYEh2JmDt1J3y/R:QXklIKyWYI2IhfYl12Hk

  Score

  10^/10

  formbookhs3hdiscoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2