Overview

overview

10

Static

static

10

fd1e8b3716...b2.exe

windows7-x64

1

fd1e8b3716...b2.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    fd1e8b3716764f552b7350c4612cfc64b152ded240b6f2a38426d43efeabc7b2.exe
  • Size 181KB
  • Sample230306-kep7eabc82
  • SHA256 fd1e8b3716764f552b7350c4612cfc64b152ded240b6f2a38426d43efeabc7b2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratjn85formbook

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • jn85

Decoy

  • 106c6423c3.com

  • vittoriospumpherston.co.uk

  • furniture-best.com

  • employersfindme.online

  • colegioagustinruiz.com

  • fuziservice.com

  • differentlokal.com

  • azzfasst.com

  • kerncereus.online

  • johnschottllc.com

  • disembark-burgeoned.click

  • cabliviwarranty.com

  • justzionism.com

  • diplomy-ua.top

  • cloudadonis.com

  • vaalepoxies.africa

  • ky2088.vip

  • gsportal.africa

  • alphastrength-us.com

  • homerams.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat

File Explorer

  • fd1e8b3716764f552b7350c4612cfc64b152ded240b6f2a38426d43efeabc7b2.exe
    .exe 181KB

fd1e8b3716764f552b7350c4612cfc64b152ded240b6f2a38426d43efeabc7b2.exe

  • SHA256 fd1e8b3716764f552b7350c4612cfc64b152ded240b6f2a38426d43efeabc7b2
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Formbook payload

    rat
Minor OS version
Major OS version
Entry point
127280
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths