formbook | 632-66-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

632-66-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

4e79f4b594caf0ff6f022007b24de5f8
SHA1

f93c3269a3c9e613b04f67aad750cf42edc05d4a
SHA256

f550c6b152bfa62284424dab4c64947cef6a3e3ff134c07c41eb5db16c7f6184
SHA512

95709f08605737841837b89284263d45cf93fb0c25ded67e584083ad29c1a042aa59b9b35a033f726afb1cf4324a443dc21d290384a738421222be8d4fb982cd
SSDEEP

3072:abyEEv1bhnYE73J8RfFzkNd8aXI/paIVHNiQHcgTZHdJg:fLTJ47aXI/VlVNT5dJ

Score

10^/10

rat dn12 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn12

Decoy

ownersknow.com

echotextile.com

akininternethizmetleri.com

treksurfer.com

kennerreality.com

landmanrealtor.com

ideanbfear.life

spoiledskinco.com

tampacaregiver.com

anglogoldahanti.com

tectonicsarchitects.co.uk

pick-a-fruit.com

servicesclub.club

fysjdc.com

lvfacai.com

ishiccandles.com

szlsk17.com

verified.coupons

pvoffice.com

inthefieldllc.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

632-66-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB