General
-
Target
JaffaCakes118_eb75ef667ea9c9bccc8ad8b121fc01cf37027441b1bd0271e7eb6ccc064dc925
-
Size
133KB
-
MD5
0871a401709aff12e85f8ea37f5c2625
-
SHA1
d57b089fccc6b1938a583d3675b5232de8a56a5e
-
SHA256
eb75ef667ea9c9bccc8ad8b121fc01cf37027441b1bd0271e7eb6ccc064dc925
-
SHA512
76ffd1cd879c59aee1c609525c5e034ab35327684bd935701c7b88a1faf3ffb6cd9885d77102348a43665dcc554b79de2d45abe2e1d6a7c5e15b2a04c97ddc43
-
SSDEEP
3072:Ml8IDdB1PQ6QuhfBGpPejYe+UJNMH/nu0DAjpAFByfC33tQs:MuEB1PXzGpPaYe+UIHm0DcpAPf3tQs
Malware Config
Extracted
formbook
4.1
zvf
slimytrout.com
ericdykema.com
pennystanwayart.com
auliawijayadecor.com
iyundun.com
postforearn.com
xn--4dbaigbvbe5b1a.net
fishhousemarketandgrill.com
cqweb8.com
serverauthcheckmate.com
betterulasy.com
karenhoverrealtor.com
etigia.com
yinggehong.com
brandprtex.net
pusatcpanel.com
reidec.com
ajscghy.com
tvdajiang6.com
freightlogins.com
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_eb75ef667ea9c9bccc8ad8b121fc01cf37027441b1bd0271e7eb6ccc064dc925
Password: infected
-
formbook.bin
Headers
Sections