formbook | 1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48.exe
Size 181KB
Sample240227-nvkhmsgc7z
SHA256 1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48
MD5 9ccac33dd67e893f981309740ac5be95
SHA1 807eac323f0cb5c97498d6e297f60d1c31cd4603
SHA512 080ecfb652454faaf748afd4a50788a6559599160092b9fdcce4df124e57286cae34a1ae56b7d5095628bfcdffd49220ab7306304522339701e1274187c9c40a
SSDEEP 3072:WZQVBxEMfaGNQ+O73huKiZkJm0UqdNsiwxaV2aDiFk+1Kgx/Je5CGvIs20cUPUjz:W+9QPThh14qbsiGNLtT2CGvCUPKz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat pz08 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

pz08

Decoy

deespresence.com
fanyablack.com
papermoonnursery.com
sunriseclohting.store
jenstandsforarkansas.com
lkhtalentconsulting.com
baerana.com
hyperphit.com
davidianbrant.com
itkagear.com
web-findmy.site
liveforwardventures.com
skyenglearn.online
studio-sticky.store
yassa-hany.online
tacoshack479.com
bigtexture.xyz
erxkula.shop
go-bloggers.com
qwdlwys.site
taylorpritchett.com
yobo-by.com
trendsdrop.com
boostyourselftoday.com
taxibactrungnam.com
sgzycp.net
anti-theft-device-82641.bond
ytytyt016.xyz
loveyourhome.style
ithinkmoney.com
bertric.info
permanentday.space
kxn.ink
onlythumbs.online
techrihno.com
washing-machine-46612.bond
phdop.xyz
nordens-media.com
gourmetfoodfactory.com
ketoalycetiworks.buzz
amplilim.site
usetruerreview.com
inprime.xyz
aloyoga-uae.com
quickfibrokers.com
primadesignerhomes.com
greatlifehacks.online
thewipglobal.com
tobegoodlife.net
hotelfincamalvasia.com
trevts.com
ae-skinlab.com
grammarhome.com
cld005.com
first-solution.online
keylabcerrajeria.com
besttravelsgate.com
friskiwear.com
hedrickmanufactory.com
pinewell.world
5819995.com
c2help.live
kai3.center
plantasdasminas.com
rdlva.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48.exe

File Explorer

1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48.exe

.exe 181KB

1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48.exe

SHA256 1ca7cea9b070c01b4a5e6f72f2fe9f975f56b00131329357b9b14da69ff5ab48
MD5 9ccac33dd67e893f981309740ac5be95
SHA1 807eac323f0cb5c97498d6e297f60d1c31cd4603
SHA512 080ecfb652454faaf748afd4a50788a6559599160092b9fdcce4df124e57286cae34a1ae56b7d5095628bfcdffd49220ab7306304522339701e1274187c9c40a
SSDEEP 3072:WZQVBxEMfaGNQ+O73huKiZkJm0UqdNsiwxaV2aDiFk+1Kgx/Je5CGvIs20cUPUjz:W+9QPThh14qbsiGNLtT2CGvCUPKz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths