Overview

overview

10

Static

static

10

1496-64-0x...ry.exe

windows7-x64

1

1496-64-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1496-64-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    2120737ef87ed764aa064bf5f2ef20a3

  • SHA1

    23e4aaa9102ced1e890bf3236b5389a50c509af9

  • SHA256

    5197c801f416a3443a3a5a166518f8380bab2f79c00039fd9573ba3df1f04cf0

  • SHA512

    adfe56eb9d270eb9c84998758315d3aac6cf46f616a5f07a917d642c328c0970e8922debc999c7d2cf011a48fab1666d2586960d5fa20aa51cd67f75094318a6

  • SSDEEP

    3072:Ohg0Fr/0hgQHo95rYER+uHNZm6DYVOCuwCFoI0Xc8ygbDDw0n16:Xy0ePYEb66DYVEwCOIB8XDPn4

Score
10/10
ratee2qformbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ee2q

Decoy

uspbs.top

proflidi.com

fcsawftffcoffical.buzz

rustie.link

mflol.uk

safepalercclaim.buzz

tuomamoban.com

gxkchp.live

kfpu.store

bjcxks.com

netfiix-account.info

flyonex.com

faranstechtalk.com

littlenuggetproperties.com

greatpromo.site

bricepacific.com

yourhometownappliancerepair.com

citrixsettlement.com

delivery-broccar.com

inncur.space

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1496-64-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections