Overview

overview

10

Static

static

10

2c213fde91...2e.exe

windows7-x64

1

2c213fde91...2e.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e

  • Size

    188KB

  • MD5

    238c0dd0f3e2f2c1d9028403b2fa3dbd

  • SHA1

    9c4797bc9fc9b2c464ce67e09fd2061d83ea5622

  • SHA256

    2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e

  • SHA512

    88071c56161c3d61177a63a56c37be3035e9cca2a78c9221527d2dd3fa1502ea33ca63cd87d4ac0a66d24b104d51b4c468e6d80a9a38ac3cf61cc3f9e1c8b59c

  • SSDEEP

    3072:z4wEf8uObLGws37JyfqTaaCWx8TZo4+tHGKR/WpXAd+:ePwi7cfBaCWxSZozGc+pXA

Score
10/10
ratps15formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ps15

Decoy

57797.asia

jhpwt.net

basketballdrillsforkids.com

zgzf6.rest

casinomaxnodepositbonus.icu

uptocryptonews.com

gomenasorry.com

fortanix.space

stripscity.xyz

genbotdiy.xyz

mayson-wedding.com

neb-hub.net

seancollinsmusic.com

migraine-treatment-57211.bond

prosperawoman.info

tradefairleads.tech

xn--yeminlitercme-6ob.com

xwaveevent.com

fashiontrendshub.xyz

window-replacement-80823.bond

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections