formbook | 57c88bc5decb0704871464e6444ab639_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
57c88bc5decb0704871464e6444ab639_JaffaCakes118
Size 167KB
Sample240519-ber7bsaa4v
SHA256 9c7d406369303ff67f47268c86b7ef94fe3a953133c8865bdd5caab09b526f50
MD5 57c88bc5decb0704871464e6444ab639
SHA1 3d153956f9cb278e400d5c1ec8ffb7ceb11fd668
SHA512 c211b054acabfe394416abd23e03e1f9af3be5b48e6f05327eea7aab94103e75479718bff26c7b0867d0bb9a4f7d2dafdbb9499aaa503706d76088807217315a
SSDEEP 3072:qqzle+c1kF3GqzZrJXog9nTjaY70vEslNckApoHVaBXUwPiLJZ:BOkDhJXV9TjaYo8pAYBXUwKL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat mr formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

kaitorihappy.com
locationmaisonbretagne.com
babyfactorydirect.com
arcticsurgicalgroup.com
togethergame.net
workflexibility.net
classifieds4all.com
leticiadetoni.com
eth316.com
siapapunya.com
bitcoinwissen.com
cdrbzxx.com
lrselectrical.com
mylsxd.com
nacimprint.com
824qrq.info
artdelaseduction.com
premiumglassdesign.com
0y0twosuper.loan
allallies.com
venturesiren.com
joarno.com
xn--3bsr78ac6duq5c.com
ficci-bstars.com
vnouchet.com
etf-matic.com
loopchem.com
livehdonlinetv.com
jonnielbazan.life
waltonessa.com
bizimadanagazetesi.com
moloevents.com
407uuuu.com
loshappypeople-mail.com
targetpsoriasis.com
houseprosnow.net
axesspointafrica.biz
revolving.credit
rfodg.com
chuyennhathanhhung24hhanoi.com
nwcdc-mo.net
harlenknights.com
screening.support
cordeze.rocks
dvdasia.site
www07opus.com
xiaojingxi.net
tv18090.cloud
fylingenieria.com
livesting.com
apprenticeshiptexas.com
aiprt.com
thinklikestartups.com
verway-leben.info
33444blg.com
adxcargosurabaya.com
chshinfo.com
news3065.pictures
1280pe.com
mrderricksdrivingschool.com
shisoka.com
magrandefamilletg.com
cliquescreen.com
333i.net
hacdop.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57c88bc5decb0704871464e6444ab639_JaffaCakes118

File Explorer

57c88bc5decb0704871464e6444ab639_JaffaCakes118

.exe 167KB

57c88bc5decb0704871464e6444ab639_JaffaCakes118

SHA256 9c7d406369303ff67f47268c86b7ef94fe3a953133c8865bdd5caab09b526f50
MD5 57c88bc5decb0704871464e6444ab639
SHA1 3d153956f9cb278e400d5c1ec8ffb7ceb11fd668
SHA512 c211b054acabfe394416abd23e03e1f9af3be5b48e6f05327eea7aab94103e75479718bff26c7b0867d0bb9a4f7d2dafdbb9499aaa503706d76088807217315a
SSDEEP 3072:qqzle+c1kF3GqzZrJXog9nTjaY70vEslNckApoHVaBXUwPiLJZ:BOkDhJXV9TjaYo8pAYBXUwKL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths