Overview

overview

10

Static

static

10

ddff78904d...b2.exe

windows10-2004-x64

3

ddff78904d...b2.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    ddff78904d78b6eca747dd889e3ce886fcb80ff4ede2e545d3479413575519b2
  • Size 185KB
  • Sample260628-grb9jafv8x
  • SHA256 ddff78904d78b6eca747dd889e3ce886fcb80ff4ede2e545d3479413575519b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ratn7aktrojanspywarestealerformbook

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • n7ak

Decoy

  • wise-transfer.info

  • jam-nins.com

  • thebestsocialcrm.com

  • majomeow222.com

  • ancientshadowguilt.space

  • gentleman-china.com

  • parquemermoz.store

  • taxuw.com

  • sharqiyapaints.com

  • libraryofkath.com

  • 1949wan.com

  • synqr.net

  • bitchessgirls.com

  • btonu.cfd

  • coding-bootcamps-16314.com

  • leadership22-tdh.site

  • maximsboutique.com

  • irishsummertruffles.com

  • sdnaqianchuan.com

  • uyews.xyz

Signatures

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • ddff78904d78b6eca747dd889e3ce886fcb80ff4ede2e545d3479413575519b2
    .exe 185KB

ddff78904d78b6eca747dd889e3ce886fcb80ff4ede2e545d3479413575519b2

  • SHA256 ddff78904d78b6eca747dd889e3ce886fcb80ff4ede2e545d3479413575519b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:5windowsx86arch:x86

  • Formbook payload

    rat

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
1
Major OS version
5
Entry point
127296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths