formbook | JaffaCakes118_78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561
Size 182KB
Sample241224-aa5feswldj
SHA256 78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561
MD5 53507d5f1a0dfe435ef7d81c2995f473
SHA1 48519b26bc7192cd7e0a6033d33163a8f5e59b95
SHA512 9242aa6e1ad4a8f3e942ff6809d3813baa6bc41e25a6fd40f475ae90edbc1905b64b0a1dec34266f3887fa4b40f85c695640bf7fa2c4bd48746eae6999b1e1af
SSDEEP 3072:sXNcgjPLe71ieAcoMgqLB/agrwTXipSbMRaokYNqDcYM1ztT:O6McotMagcmpSbMXh3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat iic6 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

iic6

Decoy

screaminyourcarday.com
nbhindustriesptyltd.com
ntgmfublb.icu
bombayracks.com
phoenixlights.net
rachelamosphotography.com
leapforwards.net
sendai-salt.com
shabbychicflipsbyangelina.com
core-ol.com
canalysis.net
tybeeprohibitiontour.com
influencedarts.com
italivpn.com
newborn.today
garagedoorroundrocktx.com
participi.com
thegoddessnow.com
invesito.com
surfingnaked.com
sunsetsalesforce.com
revolution4kids.net
kingbookvn.com
realsteelpocatello.com
ubitem.com
forretningsfilm.com
liberationcreation.com
jfaudiovisual.com
fashinnovation.institute
4628ridgemont.info
advocatenunie.com
sheilaalvarado.com
gun-barons.com
muyupin.com
nolanshotsauce.com
chile-commerce.com
alekhyasarees.com
digitalcollectionservices.com
rhwlc.com
dondeestanlospacientes.com
haxb33.xyz
sageolegoats.com
strongpowerlive.com
allianceofamericanlawyers.com
applywithrand.com
wwdyson.com
rivertigerresources.com
njbjjt.com
lemarcel.online
unetgallery.com
zajedyne.com
aodiq3.com
profitcart.xyz
mrnord.com
melisaweb.com
picskicks.com
ubiquiti.lat
long0321.com
mediherz-shop.com
digitizersfriend.com
ford17tv.com
seawalker.art
serum.mobi
weblst.com
ozsmarthomes.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561

File Explorer

JaffaCakes118_78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561

.exe 182KB

JaffaCakes118_78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561

SHA256 78e1002548eaa8e32170fdd141ccf8ce9d662696cc22d26c275e92244e5df561
MD5 53507d5f1a0dfe435ef7d81c2995f473
SHA1 48519b26bc7192cd7e0a6033d33163a8f5e59b95
SHA512 9242aa6e1ad4a8f3e942ff6809d3813baa6bc41e25a6fd40f475ae90edbc1905b64b0a1dec34266f3887fa4b40f85c695640bf7fa2c4bd48746eae6999b1e1af
SSDEEP 3072:sXNcgjPLe71ieAcoMgqLB/agrwTXipSbMRaokYNqDcYM1ztT:O6McotMagcmpSbMXh3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

126112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths