formbook | f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3.exe
Size 181KB
Sample240409-dbf11acc57
SHA256 f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3
MD5 517d168a3e886e3c0a8275881631eadd
SHA1 d16913a1f3b0a846c39a9838b92f2be5d5e0e739
SHA512 f4939e900d2ccee82384c374a76b0d6d35bcc175aaaeb1451c2db1e7c64af9e42507ced81abae8b49a4bb86313fb0f29aee1b24c01b7a859420f3bf3ffcbc5f8
SSDEEP 3072:JxEUkOmDbSNE3OIF1KLaA6i/h/lrQ7Rj4+aYS7JSWoE:jfqO81KaA6ippaXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat kh11 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

kh11

Decoy

theluckypaddle.net
assurelinkenterprises.com
gazpachogroup.com
worxservicesllc.com
bestecankurban.com
cotebrief.com
899173.com
navist.io
metaverseharem.com
genpower-plus.com
drhandgrip.com
jessicachristina.com
eidura.com
cat2000andhope1izfanfiction.com
nywaiverlatam.com
cdlb9twt.shop
j2mjewerly.com
itsmisshodges.com
timeis.shop
santefe4g.com
ongame.cloud
guard-dd.online
rutgersorthopedics.com
rkbengg.com
dentalemergencybakersfield.com
jansirani.com
gadilglobal.com
unitygiftingco.store
enxk-32.com
northcuttmediacompany.com
hyyhldz.site
stripperscontest.com
lexcomtech.com
issndiploma.com
shopynuts.site
shpoifypos.app
gamer24.top
dibujosparapintar.net
healthinsuranceudeserve.com
pampadev.tech
whefgf.club
riversandcapital.com
foroupskirt.com
wocan92.top
onehourbookclub.com
brochuresenligne.site
suv-deals-85472.bond
coalswap.com
tresxop.xyz
juniortrevisol.com
it-jobs-87776.bond
black-loan3.shop
chicprems.xyz
pmheiouassessment.shop
186489.support
88mahadewa.vip
vn90129.me
cattaillake.com
jmknoh1r.shop
attitudedancefitness.com
eventcrrate.com
autonomoangola.com
jollshopp.com
thesimplestudio.io
gltip2le.shop

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3.exe

File Explorer

f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3.exe

.exe 181KB

f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3.exe

SHA256 f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3
MD5 517d168a3e886e3c0a8275881631eadd
SHA1 d16913a1f3b0a846c39a9838b92f2be5d5e0e739
SHA512 f4939e900d2ccee82384c374a76b0d6d35bcc175aaaeb1451c2db1e7c64af9e42507ced81abae8b49a4bb86313fb0f29aee1b24c01b7a859420f3bf3ffcbc5f8
SSDEEP 3072:JxEUkOmDbSNE3OIF1KLaA6i/h/lrQ7Rj4+aYS7JSWoE:jfqO81KaA6ippaXh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths