Overview

overview

10

Static

static

10

winprofile

windows7-x64

1

winprofile

windows10-1703-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    c90a5302afc1cb44b4157f1fbd69926c4c223a215d9bcc2be2975b95c1005760
  • Size 185KB
  • Sample240725-2rls7azdpl
  • SHA256 c90a5302afc1cb44b4157f1fbd69926c4c223a215d9bcc2be2975b95c1005760
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratdn03formbook

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dn03

Decoy

  • almouranipainting.com

  • cataloguia.shop

  • zaparielectric.com

  • whcqsc.com

  • ioco.in

  • aduredmond.com

  • vavada611a.fun

  • humtivers.com

  • jewellerytml.com

  • mcapitalparticipacoes.com

  • inhlcq.shop

  • solanamall.xyz

  • moviepropgroup.com

  • thegenesis.ltd

  • cyberxdefend.com

  • skinbykoco.com

  • entermintlead.com

  • honestaireviews.com

  • wyclhj7gqfustzp.buzz

  • w937xb.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • c90a5302afc1cb44b4157f1fbd69926c4c223a215d9bcc2be2975b95c1005760
    .exe 185KB

c90a5302afc1cb44b4157f1fbd69926c4c223a215d9bcc2be2975b95c1005760

  • SHA256 c90a5302afc1cb44b4157f1fbd69926c4c223a215d9bcc2be2975b95c1005760
  • MD5 SHA1 SHA512 SSDEEP
windows:5windowsx86arch:x86

  • Formbook payload

    rat

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
1
Major OS version
5
Entry point
127184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths