General

  • Target

    4640-146-0x00000000005A0000-0x00000000005CF000-memory.dmp

  • Size

    188KB

  • MD5

    aa79c097d39a75beba2a68cd01e8aaa9

  • SHA1

    32c8de59d6b7b56b6640ab4ae709b0ec3b50489a

  • SHA256

    9c57ffdce8925a559d73ddb5bd2c472d86ccd120fbbdcf0aef7c2dbc46c71119

  • SHA512

    4afd40031d0169308a84651c1c1c5792c810f8169595839d8c3028e8a14853d48d8e2e5c0b654c613d041c06bb334c74a1db9a93c8bb8e3e626f15d3d4250f20

  • SSDEEP

    3072:f4f/UhkJDN/MurZR3q++3fQRjEKbIzuPXdOXUoQ+amyeGIXUM6sjIi4srraGt:wFxnql4mKbIzuPNcDlesFjIi4cZt

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bn04

Decoy

tmsinter.shop

playfortuna-id.top

cinemagowovuy.com

preciousmomentsevents.net

bestgertijaherusa.com

acger.art

iplayrj.shop

mallmaps.app

hrfu.info

regalospublicitarios.online

sparklecleaner.store

listsmatch.com

awakenthewisewoman.community

deliveryservice-getaddress.net

changzhirexian.top

xyjsq.top

air-bs.com

fusionisticart.com

menosaka.com

tightsafe.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 4640-146-0x00000000005A0000-0x00000000005CF000-memory.dmp