> Family · formbook: AutoIt-delivered infostealer with shellcode bootstrap_

~/packetpursuit $ cat /intel/families/formbook.md

typeentityconfidencemediumcreated2026-06-27updated2026-07-12malware-familyinfostealerautoitobfuscationdefense-evasionexecution

formbook

Commodity Windows infostealer family. Preliminary triage tag; both observed samples are AutoIt-compiled droppers that unpack to a native PE payload via an embedded shellcode bootstrap. The outer AutoIt layer uses obfuscation to hide API names and payload data.

Build Stack Typically Observed

  • Outer layer: AutoIt3 single-file compiled PE (interpreter + script embedded in .rsrc type 10) ^[rabin2-info.txt]
  • Obfuscation: Stride-3 hex decoder (C33JA) that discards every 3rd character as noise, decoding API names and DllStruct signatures ^[script.au3:27-34] ^[/intel/analyses/3424a53f5b4c7422f142ec1e6460b55e5da222113d45e9cf4f2f9f1013e3bcaa.html]
  • Anti-analysis: GetTickCount timing gate before payload execution; exits if Sleep delta deviates ^[script.au3:36-45]
  • Inner payload: High-entropy binary (entropy ~7.995), no readable strings without dynamic decryption
  • Bootstrap: Shellcode decoded from hex-encoded file, allocated RWX via VirtualAlloc, jumped to via DllCallAddress at offset +9136 ^[script.au3:58-61]

Deploy / TTPs Typically Observed

  • T1059.005 — Visual Basic / AutoIt execution ^[file.txt]
  • T1055.012 — Process Injection: Reflective PE execution via VirtualAlloc RWX + DllCallAddress ^[script.au3:58-61]
  • T1027.002 — Obfuscated Files or Information: Multi-layer string obfuscation (stride-3 hex encoding) ^[script.au3:27-34]
  • T1497.001 — Virtualization/Sandbox Evasion: GetTickCount timing gate ^[script.au3:36-45]
  • T1105 — Ingress Tool Transfer: FileInstall drops payload pair to @TempDir ^[script.au3:46-47]

Variants / Aliases

  • Formbook (preliminary tag from triage)
  • XLoader (historically related; same codebase fork)

Notable Analyses

  • a4cb4c76 — AutoIt dropper with PFMD87JH468RAUYH XOR key, pteropod/bohmite payload pair, 2024-09-02 compilation. (/intel/analyses/a4cb4c76933ac72570a90a7bb73c6dc6cdc791db10697aa10bf70dec8835e53c.html)
  • 3424a53f — AutoIt dropper with C33JA stride-3 hex decoder, finitism/extrorsal payload pair, PO#86637.exe purchase-order lure, 2024-08-25 compilation. (/intel/analyses/3424a53f5b4c7422f142ec1e6460b55e5da222113d45e9cf4f2f9f1013e3bcaa.html)

Capabilities

  • autoit-stride3-hex-decoder
  • shellcode-bootstrap-virtualalloc
  • reflective-pe-injection
  • temp-directory-payload-staging
  • xored-pe-payload
  • api-name-string-obfuscation
  • gettickcount-timing-gate
  • fileinstall-payload-drop
  • purchase-order-social-engineering

False-Positive Co-Labels

OpenCTI occasionally co-tags unrelated samples with formbook based on social-engineering filename overlap. The following sample is not Formbook:

  • 64e2d169 — .NET Framework 4.5 AvalancheRunner game masquerade (TT01650Q0986854CNAMX.exe), AutoIt-free build stack. See avalancherunner for the real family attribution. ^[/intel/analyses/64e2d169d90930905374a2f504cfa6a06276333533875b7a7d076cb2c472ae6a.html]

Related