Overview

overview

10

Static

static

10

5056-140-0...ry.exe

windows7-x64

1

5056-140-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    5056-140-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    4c86fd29b4ba5aaff6dd020f1c2042b8

  • SHA1

    9fcacf35cf12d5b6d3477d90823631c56c5c3a95

  • SHA256

    f0c031d10bd3e482322b09f002b86b59fedcb6417588ecb82e3161b3d8a85550

  • SHA512

    edc6c2c5024d4a306060b2f1f0462ead2e6344d34ef652d64a807fddb58a909547344fed6973469775c84496d5b13b5979f6a95a30a1d194dfe0ae54bfd1d960

  • SSDEEP

    3072:5SNjhNEOBj6Dd134UZ/Lnw3aAdalxRsoh/mzEEI+lAoXa4UNmbqf9:5SP50ZllL8aAdalxdh/RwlACU8eF

Score
10/10
rata0a2formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a0a2

Decoy

littleconcernsociety.com

baigaoedu.com

jatpoloclub.com

luiwox.xyz

bearardath.com

infoversilia.com

ot-to-j.com

sable40k.com

whatravthinks.com

angelnajeraperez.com

juegosfriv2019com.com

i205towing.com

shmyhzd.com

dayschevorlet.com

ingnance.com

melaniemetheny.com

bigmatcarex.com

mbdgiftgallery.com

livesolerev.com

swimsuitlageprijs.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5056-140-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections