formbook | bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2.exe
Size 181KB
Sample240408-jptrxacc54
SHA256 bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2
MD5 63143654685be4899ed0d2da5281ac08
SHA1 7967c0585678836cdaf8f9fd744c42fb4c329736
SHA512 a09f7c6f7e5412ac70b98947a8d4acc4b309e69f03fa8dcea4e330856795eca5f54e497b93ad4fe9f4d7da6a3d85720cd45751a2e5341d24483cdf2110d4de7d
SSDEEP 3072:FWfqxEcElcY/7Bc3Uh5ztebFk2e7yM78b5LvPvn2X/dXLuFUF1kY/B0:oWExlSUrcbFk2e78ljP+XlX51kqB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat fs83 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

fs83

Decoy

blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2.exe

File Explorer

bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2.exe

.exe 181KB

bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2.exe

SHA256 bddecf330d5b3d2c09db0b26dc6367e2e71a2e0317cc65610cd1cca8809fd0e2
MD5 63143654685be4899ed0d2da5281ac08
SHA1 7967c0585678836cdaf8f9fd744c42fb4c329736
SHA512 a09f7c6f7e5412ac70b98947a8d4acc4b309e69f03fa8dcea4e330856795eca5f54e497b93ad4fe9f4d7da6a3d85720cd45751a2e5341d24483cdf2110d4de7d
SSDEEP 3072:FWfqxEcElcY/7Bc3Uh5ztebFk2e7yM78b5LvPvn2X/dXLuFUF1kY/B0:oWExlSUrcbFk2e78ljP+XlX51kqB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths