Overview

overview

10

Static

static

10

2944-67-0x...ry.exe

windows7-x64

1

2944-67-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2944-67-0x0000000000400000-0x0000000001462000-memory.dmp

  • Size

    16.4MB

  • MD5

    d73b642961b91971f43efd798a7fbc7a

  • SHA1

    c5b626255a212c4d937179d037209b9379729c5b

  • SHA256

    f1d186a09c3e9e673335b213f86b568f66bdcd16ffed707bbe6b4bc2f16b99b3

  • SHA512

    6d3768533f6ddb41cf9a3622a325d70b511324bb4fb5eb3d69d8f8fff01fd18b39fffe3d837a2a599ad81c7b574c54ec381ec375b97ae5a972a7c91752c2405b

  • SSDEEP

    3072:bNF1k7QVS7zc33F2ifPaBMgaTjjlWEas/24cx+7I7XMh/GUTws:0+HFpfPfgaTjj2s/ncx+dGUTws

Score
10/10
ratau22formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

au22

Decoy

thirty4llc.com

gfoke.com

umso.community

grupoaguiaempreendimentos.store

dvineshirts.com

pbrcenter.com

bruckerproperties.com

amreeshchandra.com

wel-cote.com

bigeasytripods.com

pbwyx.com

honeyburnx.com

matiamahal.com

yummyhairproducts.com

2025yh.com

williesales.com

philoslabs.com

stayinwhaus.com

takingstepswithme.net

cdstss.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2944-67-0x0000000000400000-0x0000000001462000-memory.dmp
    .exe windows x86


    Headers

    Sections