Overview

overview

10

Static

static

10

JaffaCakes...b9.exe

windows7-x64

1

JaffaCakes...b9.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c6431cf149a11019147a4422c90074484290510307ef674936210a0c9fd49db9

  • Size

    188KB

  • MD5

    4fdf818e749dd4c031e7394e6d761b93

  • SHA1

    e673cd68b4c0275592e19abbeccd3a45a8642073

  • SHA256

    c6431cf149a11019147a4422c90074484290510307ef674936210a0c9fd49db9

  • SHA512

    a7cd758b3b61bf12ff0fe04bc8e9b8fe985f3ca5703499724e41b8818c9a44a26b86746515db4d87d1f2b94cd7d0f097348443c375454841d5c82d53798897c3

  • SSDEEP

    3072:RfeEKn/nmpM03xoFjbQqbwWRQWQekUNAMr5yDEjymyC/m95:2NaxQjsqbwW4ekUNX5yDoymH

Score
10/10
ratky13formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ky13

Decoy

haixiangfood.com

stayat30aandbeyond.com

gyakutannikki.com

kouken-web.com

golden-ears8.xyz

prombanking.com

globalinvestmentsblog.com

impactliving.life

akvamaster.net

orbitercl.com

gue-elektrotechnik.com

yolo9-ukraine.store

undividedsociety.com

digitashore.com

youcangethim.com

cczbjx.com

bam777.com

flbmqkyvpnqlegt.xyz

crawlananalyse.com

doctorcarehealth.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_c6431cf149a11019147a4422c90074484290510307ef674936210a0c9fd49db9
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections