Overview

overview

10

Static

static

10

2032-72-0x...ry.exe

windows7-x64

1

2032-72-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2032-72-0x0000000000400000-0x0000000001462000-memory.dmp

  • Size

    16.4MB

  • MD5

    735d0be7f56ef360eec4bdd57b4b3cfd

  • SHA1

    15b65a036d192ee60b55e8497ba54249ac16b398

  • SHA256

    c9ac3d5f5290c11a74892be2e9fa14afbfbed737fb5298de4d132426b6d8b0d6

  • SHA512

    50bc0488cf94ed7e1ee609c5dc14a3a5f9ba95510fd901991f12004aa34a696d2d682330f0ba1dfe2344770d70157ff1538321aff9a6f0b3af7404a9bd86640d

  • SSDEEP

    3072:CgrEmBwv/dPfW3+g0A/ocqBa4hRhtRTRPF7wxuGxZm/wfuUQdNs1LY:lMA+JA/fqBa4hRh3TRPtQx7QA1Y

Score
10/10
ratbb27formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bb27

Decoy

californialivingbenifits.com

lifestyleisrael.com

fmgy.love

theresidencesparis.com

divers.pics

flezibuy.africa

kalidaddigifirm.com

herbal-nutrition.uk

zaiana-store.com

702thrill.com

justfoodup.africa

ebctec.net

cansucudesign.com

qy-zh.net

siokul.xyz

mustech.africa

haber-apartments.com

camilaandrademakeup.com

home-decor-86543.com

fzui.xyz

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2032-72-0x0000000000400000-0x0000000001462000-memory.dmp
    .exe windows x86


    Headers

    Sections