Overview

overview

10

Static

static

10

1984-66-0x...ry.exe

windows7-x64

1

1984-66-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1984-66-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    b45821bb01674d65f509bc388205d854

  • SHA1

    87d19954a46cc4aab3913e0aa35238f262be7fa9

  • SHA256

    c41a6fdbf2bd69345de8fa1cc62dabee08833418231135d864fca67a17880d08

  • SHA512

    8c57b895327a11c5942c9e38b1dc06ed47963330fea7c3a6f3c3e721c14c431b748a8a94160186c4cf9a5948a2e3138d17dc266d3e94f2ddbb3c48dda99d6d89

  • SSDEEP

    3072:gerL7kbtxxIeoFX3kVaqdm1qhjx8NPcizHPXOjrGoZwvsRyj:UtunkANqhjx8NPHzUyfk

Score
10/10
ratkp16formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kp16

Decoy

pulundym.com

whiskeykitty.com

mspuser-yy2002.click

merchantuniversalsummit.com

divinerow.com

0974mm.com

stormbayou.com

corporacionjebeemsa.com

theriversideattroy.com

67ucb.live

crecimientoia.com

atqfoods.com

17ufr.live

todayshomefurniturega.shop

elpoteresstaurant.com

bureacrazy.com

powerfull10.click

lnyzsw.com

wwwaflds.com

bukucbd.net

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1984-66-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections