formbook | d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a | Triage

Sharing

General

Target

d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a
Size

256KB
MD5

91c7ed04f7cc1b8d29673fc66aa71e20
SHA1

f412b5ad356c62d190f2d95ffaf7f15ca881489b
SHA256

d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a
SHA512

e40e603f321860a46de133f82f9e7f0bb5afdea070e64a84e974a7c659c12beef9936f88bd07710a1c17ffff9523a8cd6485fc61ed9b5d5261c7d310bc326993
SSDEEP

6144:dbuC7j7eTLBoJRQ1OxY0RdHAgueC+wKnRk+ecVHQzVEY:dbJeT1+G0rBDGKzeIQzV

Score

10^/10

rat formbook

Malware Config

Signatures

Formbook Payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/01308.exe	formbook

Formbook family
formbook

Files

d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a
.zip
01308.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ