formbook | JaffaCakes118_bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b
Size 188KB
Sample241230-ws4gqsvmfx
SHA256 bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b
MD5 47028fb473b19ffd42e8d330c8bd9e3f
SHA1 3a72219d783f76203573359c3d5ca23476833ef7
SHA512 d1be31d6b5b2576f5b77e6e9365220d3816113131290f24cd98843ce9d335c2227b1261b85f269aa8318cba9007652b56101e5ae24fc05329074d851e3c92411
SSDEEP 3072:9LdEuhq0cbs36kIAL9aJFRlNibl5jW1uvtiuELxNPmK+DrQruYw2:zUi61ABaJFR/ElZFtVGPOHY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat mr06 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

mr06

Decoy

dreamrose.shop
bamdadlive.com
avastfr.com
aishabolduc.design
nobulldownhill.com
navis.store
paintingsantaclarita.com
wdidfhqo9751ds.link
epilateurlaser.info
expertdoctor.xyz
jtfaqyxo.work
zrexvita.live
coloradomarketingfirm.com
prestigehospitality.solutions
bmayple.com
sea-food.online
mejor-proteccion-es.click
tophatlimitless.buzz
inailshickorycreek.com
tintash-sg.net
epistratagem.com
ky7437.com
ky9261.com
3308bet.com
agavedev.net
harveycrabtree.store
culturalculinaryexperiences.com
ksecurityblog.online
store-lunarclient.net
memorylocketsandcharms.com
cz-handbags.life
capsulacorp.com
pralniacms.online
shutro.online
hataymutfagi.xyz
fghfh.xyz
itconssharing.pro
nxcz.xyz
nineid.pro
espacoreconexao.online
indieglenboutique.com
thecooper.store
natura.yoga
foggel.net
remaxunity.com
tcykv.site
facialsandmore.com
staemcommmunlty.online
frituurchapeau.com
boatparty.online
socialmediaaudiences.digital
trinidadrealestate.net
hglx.bar
cardiopathy.online
vermont14selfstorage.com
highthunderrecords.com
85343.top
hechoenapure.com
dawgly.net
zonazerogamescomar.link
irremissible-moveless.info
easylearn.click
online-store48.com
cupangrejeki.click
revyoume.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b

File Explorer

JaffaCakes118_bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b

.exe 188KB

JaffaCakes118_bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b

SHA256 bd0a5bec7294d7e843a40f8506ee48c64997088c06c42d5e4d38d05240cb329b
MD5 47028fb473b19ffd42e8d330c8bd9e3f
SHA1 3a72219d783f76203573359c3d5ca23476833ef7
SHA512 d1be31d6b5b2576f5b77e6e9365220d3816113131290f24cd98843ce9d335c2227b1261b85f269aa8318cba9007652b56101e5ae24fc05329074d851e3c92411
SSDEEP 3072:9LdEuhq0cbs36kIAL9aJFRlNibl5jW1uvtiuELxNPmK+DrQruYw2:zUi61ABaJFR/ElZFtVGPOHY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths