Malware Analysis — Formbook

Malware Analysis — Formbook

Formbook is a type of malware that specializes in stealing sensitive information from infected systems, primarily focusing on capturing keystrokes, clipboard data, and form data from web browsers.

Figure 1: Malware Bazaar Entry

After downloading and extracting the .bat file, we observed a relatively simple obfuscation technique — Base64 encoding. At the end, there was a large chunk of code that appeared to be a file.

Figure 2: Obfuscated Base64 encoding + code at the end …

analysis base64 bat bat file bazaar browsers clipboard data encoding end file formbook information keystrokes malware malware analysis obfuscation sensitive sensitive information simple stealing systems web web browsers