Overview

overview

10

Static

static

10

2920-19-0x...ry.exe

windows7-x64

1

2920-19-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2920-19-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    e4c38de20406c6a915b68c086c1de7eb

  • SHA1

    135ef0121b47fd67de38492ba1295ba2703e248c

  • SHA256

    63ae0e8ce0dcacdb82f40217d680f8ac43c3fa5ed81a970549ac9689dc8d2dbd

  • SHA512

    fa8bf1896d09547a47b3955b5520a4a03c5f67a42d768301da73b5e52bb9f4bf994864396c8954185d8c11f348ea82f8ca14544609ce6b0d2007f9255a20851e

  • SSDEEP

    3072:N1bOtk/7hPdtAB3V7X4XD2aTrv81P96AKjDuhMgT1i6m:GoK9VLCiaTrvgPAAKqMA1i6

Score
10/10
ratwm14formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wm14

Decoy

spakingbang.com

thefireescapelasvegas.com

fairpricingpolicy.com

113xvipn.store

gaaraqatar.com

saapoyata.online

filmnewsfeed.com

91porn223.com

fungusdeception.com

lemmonverse.com

spitzpr-bs.info

ar-glasses-62126.bond

shopredmint.com

forecastsalesin.com

nokomislaundryservice.com

eveningjournals.skin

wudaokouservice.net

ejcbpu.top

8434walerga124.com

notadesigncompany.ovh

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2920-19-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections