formbook | JaffaCakes118_468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719
Size 188KB
Sample241230-chvbjavjer
SHA256 468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719
MD5 6129a31c2e9ef65aeed1de49e97f491f
SHA1 0841c0ed329e8fd1a23c0a4c3b0743d44f5cfdba
SHA512 41d104b9917c13818f1a1fe115a55a2cbb7d570dc8c91cabb480e1021ccee4cfe5f282f97ec0b783c0fbc8975ada00dc98968fe86a9cacbc37eed67e85d86d7e
SSDEEP 3072:E1ZNqkJ0eEY/YT3A4toGQtaiKjn3x/xqv45YMYRz7i7FnSav:4m/7A8oGmaiKj3BxFYa79v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat r1e3 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

r1e3

Decoy

floorwaves.com
leshigou.top
2y3jq.com
karobazaar.com
cookdd9.com
xn--9kqu10bhqv.top
hollieforson.com
peachso.com
gerberry.info
abslikepro.com
lesourire-official.com
dfhgxi.icu
lightofcg.com
hismozart.com
nieuwemaniervanleven.com
trimble-gs-112-cable-reel.com
putacandleinit.com
gopenly.xyz
northcountyneuropsychology.com
thekittyherbalist.com
tangkalopos.com
ethioprime.net
incredsolutions.com
thecandlecasa.com
china-scu.com
foxue.wiki
rh7jmbet.xyz
growthpesa.com
turnandco.net
livinglearning.site
ggcuan.net
yhy9.xyz
bill-address329972.com
londoninbd.com
wq516.services
zzztopia.online
lacework55ads.com
babys-b.com
budgetitworks.net
downlookup.com
a3dzdftrswfcp.site
pearbough.net
varehospitality.com
oswietleniedomu.com
hexterm.net
earthzone360.com
battlersnetwork.com
mauvecomics.xyz
llidoo.icu
aobvn.com
ainamalina.com
dietaketol.com
prospectingaustralia.gold
yoursafety.tech
adsick.com
grassrootsmedix.com
breakthroughcoaching.pro
haveitchile.com
yoodoo.site
kasper.tech
peykfori.com
dhjzc.icu
addbillsau.cloud
timesofworld.xyz
truenorthgarlicinc.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719

File Explorer

JaffaCakes118_468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719

.exe 188KB

JaffaCakes118_468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719

SHA256 468b6bb16de2b5f7b4c5c9cf269fe496ff2370147face8622e6f72ea6b6ec719
MD5 6129a31c2e9ef65aeed1de49e97f491f
SHA1 0841c0ed329e8fd1a23c0a4c3b0743d44f5cfdba
SHA512 41d104b9917c13818f1a1fe115a55a2cbb7d570dc8c91cabb480e1021ccee4cfe5f282f97ec0b783c0fbc8975ada00dc98968fe86a9cacbc37eed67e85d86d7e
SSDEEP 3072:E1ZNqkJ0eEY/YT3A4toGQtaiKjn3x/xqv45YMYRz7i7FnSav:4m/7A8oGmaiKj3BxFYa79v
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths