Overview

overview

10

Static

static

10

JaffaCakes...3f.exe

windows7-x64

1

JaffaCakes...3f.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bf67ca4a72fa8e16edab1b02223a6eb9e6ee5a0548a41715e33b961937c4c43f

  • Size

    188KB

  • MD5

    e637376604fc2b13ba14fb1eb6e4ef6a

  • SHA1

    f0b992cf1b078d044f42430d916d690d60776ef1

  • SHA256

    bf67ca4a72fa8e16edab1b02223a6eb9e6ee5a0548a41715e33b961937c4c43f

  • SHA512

    4ea9835f946cff5e6a659f90250155192f7cb2ef9c467334e4958475b36862823c4ea2ca622beb9fbe9df2a34907867cd58bcdbc060b5963cf25ae29ddc04580

  • SSDEEP

    3072:8WC9E0Mm0gXoxfoOCr+16aC+DL3CwP4OeZxWvdu4MOZntnfsgV2:TTxrCbaC+DL3CwP4FxWv8fOZntM

Score
10/10
ratb19wformbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b19w

Decoy

xcpmybuying.website

pulsechain.properties

frutapurakids.com

fundimentional.com

norsstrom.com

hispanohablantes.biz

theprophetmmxxii.com

ojifinancial.com

nexuslawmiami.com

protocoloanti.online

omega-3kidsfood.net

proyectho.com

di-lusso.net

yaluxir.com

feichentiyu.com

magasrelaciona.com

garden-offices.net

ahexpressllc.com

xn--autorematemxico-lnb.com

datanic.net

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_bf67ca4a72fa8e16edab1b02223a6eb9e6ee5a0548a41715e33b961937c4c43f
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections