formbook[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

formbook.exe
Size

612KB
MD5

15c7d310bf220ec3f38927e122cb300c
SHA1

e7c7f5fec0a8b09471384d6a0a3f91101ebfd9aa
SHA256

96f77abb1ac5786997e5bbe93b32245c169590855924a12a92c014051758ec8a
SHA512

bbec635a8737a97f3a4e2d531fd8ca40f0cbc697e0e85527d6b41ee3d1f3c8a58d3420e012f1f0cb3b04fcf0d28605bfc8b09e2b42759a22a1c757e4c9faae43
SSDEEP

12288:XR6RGxeKqnAoaiyzlHTehKN7sjcwEHa1lqMSKvC+f73M/rkd:8mqne1zlzPEcwEHqlqMfa+jgk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
formbook.exe

Files

formbook.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 610KB - Virtual size: 609KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ