formbook | 2624-12-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Target
2624-12-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample231012-qd79gsdd34
SHA256 713622b731018826f40bae961836df9b9f4124a4aa1094d347667243db1ed7aa
MD5 c7682860285da338a50c47e7bf3905cc
SHA1 3b4972f1c364e51ad9645af40ff28c87bf530b3a
SHA512 cda01a043e2f37e7d11e313f08ae899cf1d46514877bb5036291a66fb38d0e7eac1536f864cffe7b63f0d8b6e7f497a29e5d3daa721d47b4b15c4aeab2a53712
SSDEEP 3072:1JcR+klH43JNx33yQBZhScsCqq4vPz+D/4fOKSPzkI1792b4yqs1:Ymt33B6NCqq4vPz0QG/AI1792b4V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat o5gu formbook

Family

Version

Campaign

Decoy

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2624-12-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 713622b731018826f40bae961836df9b9f4124a4aa1094d347667243db1ed7aa
MD5 c7682860285da338a50c47e7bf3905cc
SHA1 3b4972f1c364e51ad9645af40ff28c87bf530b3a
SHA512 cda01a043e2f37e7d11e313f08ae899cf1d46514877bb5036291a66fb38d0e7eac1536f864cffe7b63f0d8b6e7f497a29e5d3daa721d47b4b15c4aeab2a53712
SSDEEP 3072:1JcR+klH43JNx33yQBZhScsCqq4vPz+D/4fOKSPzkI1792b4yqs1:Ymt33B6NCqq4vPz0QG/AI1792b4V
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

127296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths