Extracted

• • Target

    JaffaCakes118_397f77e9fa4a64173bdb4e97b2eca2f2

  • Size

    674KB

  • MD5

    397f77e9fa4a64173bdb4e97b2eca2f2

  • SHA1

    9e1f131229b2c427f14c4480ae4963ac089e03d5

  • SHA256

    4850acfdb42686e44bef0aaaffa11dbffe1d59db4a84def2e12a309ab09561c5

  • SHA512

    664bf4425ca4e24b48b6a369daf7af613cd94ce98382b580540022796a03c15f6fd0a6803a4c09f670f0c115a64692e42defd8e467bb048530dfad771a1e4a31

  • SSDEEP

    12288:FTPFpljp+Z+RSWz/WEFpADBtPdyYtEfXDspbRWbcVDEM14ag:FTPFTpaepwQYKObJCag

  Score

  10^/10

  formbooku1bsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2