formbook | JaffaCakes118_615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2
Size 188KB
Sample241230-ctr1jsvkhy
SHA256 615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2
MD5 32fcb15e67cc59fa53578d6923c0d021
SHA1 0e3f11f724580e3eb7c30897c3ecbdbaa24d6f44
SHA512 e0273cfcf713ba1c361fb561da01c91dac0b7381cd392ca7b36e37c14be4083a81ed2b2ad80a9391b80a5f1ca0db8171783541881462662a71285a1a6fdf03b2
SSDEEP 3072:E/UhkJDN/MurZR3q++3fQRjEKbIzePXEOXUoQ+amyeGIXUM6sjIi4srraGt:8xnql4mKbIzePUcDlesFjIi4cZt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat bn04 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

bn04

Decoy

tmsinter.shop
playfortuna-id.top
cinemagowovuy.com
preciousmomentsevents.net
bestgertijaherusa.com
acger.art
iplayrj.shop
mallmaps.app
hrfu.info
regalospublicitarios.online
sparklecleaner.store
listsmatch.com
awakenthewisewoman.community
deliveryservice-getaddress.net
changzhirexian.top
xyjsq.top
air-bs.com
fusionisticart.com
menosaka.com
tightsafe.com
mysalamcard.online
baide24.com
noosapets.net
parkshift.shop
cockpit.management
weekendcruise.yachts
606818.xyz
g1ftmalaysia.com
cpyelufl.work
edify-you.com
aircoreaudio.net
trendele.shop
034211.xyz
lfindmylphone.live
produtoonline.online
verasnails.sydney
internetagentur.net
isynetwork.com
hanma001.xyz
szcykr.xyz
sept222022.quest
trypostalforward.today
crazyaoc.com
litostrojpower.click
maisutil.store
saypha.pro
buildunity.online
dentalfly.xyz
seeyouin.xyz
tyaryubanha.shop
brookstrinity.com
thehealthspan.net
pushplaybook.com
patrickonpolitics.net
masjacsh.com
alliedbrostransport.net
superiores.shop
likezara.asia
ibb-istbakyeyklemeler.net
losyuc.xyz
supremehospitalitygroup.com
waymakersunited.site
realexd.online
ky1341.com
beautyboxbyyuliya.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2

File Explorer

JaffaCakes118_615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2

.exe 188KB

JaffaCakes118_615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2

SHA256 615570b4688de5a2e90bf65e52c2c86f6feadbb082bf35ec186d359101eef6f2
MD5 32fcb15e67cc59fa53578d6923c0d021
SHA1 0e3f11f724580e3eb7c30897c3ecbdbaa24d6f44
SHA512 e0273cfcf713ba1c361fb561da01c91dac0b7381cd392ca7b36e37c14be4083a81ed2b2ad80a9391b80a5f1ca0db8171783541881462662a71285a1a6fdf03b2
SSDEEP 3072:E/UhkJDN/MurZR3q++3fQRjEKbIzePXEOXUoQ+amyeGIXUM6sjIi4srraGt:8xnql4mKbIzePUcDlesFjIi4cZt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths