General

  • Target

    tmp

  • Size

    185KB

  • MD5

    e46b46bfc5aa1d925bb65320823fee8b

  • SHA1

    506e325008fe464a5b17971d13aad348cc1e0bf4

  • SHA256

    f5c4d1a411acaf23f8799d9e97d29010bdd0c38915aad1ed556cb26359994b4c

  • SHA512

    f536e8d89b8a404c3b602228900580b858d1918aef0d0ec8e93af287d40092a42de2fe5743721034512133ac9f0f79e7e74c1f16aaa81a23ccf898514823b1a0

  • SSDEEP

    3072:536wm/kM2mHsaCbi3zb0LF4B6aPa9+WBYJRK5K4Gkuj24kkUFZIP6Qkqgh9l:rmeLUzwLWYaPa9+WEKrvtHJjl

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ro12

Decoy

start399.com

decyfincoin.com

binguozhijiaok.com

one45.vip

55dy5s.top

regmt.pro

2ahxgaafifl.com

xn--6rtp2flvfc2h.com

justinmburns.com

los3.online

fleshaaikensdivinegiven7llc.com

servicedelv.services

apexcaryhomesforsale.com

shuraop.xyz

sagetotal.com

gratitude-et-compagnie.com

riderarea.com

digitalserviceact.online

contentbyc.com

agenda-digital-planner.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • tmp
    .exe windows:5 windows x86


    Headers

    Sections