formbook | 2960e0432aba1bf867d72d4e959c03dd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2960e0432aba1bf867d72d4e959c03dd
Size

498KB
MD5

2960e0432aba1bf867d72d4e959c03dd
SHA1

2bfc22883b6079b21097ccf0ae5206a799d0d07b
SHA256

c8a512c75aacd1445fc9e2ea8e81220188b60cd3fcf5799bbfcda496bf5c9136
SHA512

421608260461711ef4c0ff5e7633008489a4988c1c2b450256ec9e50e35ed44674228875e9243d84e199f06df2e00096a6d859f45ee229275391be6c3afe3ad4
SSDEEP

6144:2eUsLitu63e53HmJJL7XJAnY7hFhYScCppFkMFoAMUKDRAMBd:2el63eJOJHX+nOhDYynFoAMFd

Score

10^/10

rat formbook

Malware Config

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2960e0432aba1bf867d72d4e959c03dd

Files

2960e0432aba1bf867d72d4e959c03dd
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ