formbook | 1720-13-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1720-13-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

496623e6ae8f7ac8a52f0edca8847918
SHA1

ec30c1ed44ac276738678c587e4a61df0331811f
SHA256

20aeb8153c879281f938f86d7dce2ce50fea82c4c313689a214bad9db92514e8
SHA512

1515d1586ca6367ab1f35bdff74f1a95d6e044052f5e78b0c79dc8cdbc7e48a4bfda43cce184eb1de7dea7742e9334fde34dafd3cd9ef619ab0aa1daf6fbb831
SSDEEP

3072:Npl8VFDq5bLb/3QMP+9Dm8Fkwq85K+hrq/UBnb8oZL2cyIPfNp8p:UmtP+dm0tqgK+hrEatLVyIc

Score

10^/10

rat hi5f formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hi5f

Decoy

yuqdew.com

webcomponents.work

wfg.education

9490644.com

sterlingconcorde.com

va8qsy9rwa.info

octet.asia

aitaoguanwang.com

perfumariacheirobom.site

vghvdjhjd366.site

pslsjy.cfd

purseo-officiel.com

tmbet88.com

reganharrison.com

razairvestores.shop

nextlevelindependence.com

copbrazil.com

luxusmoissanite.shop

gq2s.lat

mmhjyfys531.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1720-13-0x0000000000400000-0x000000000042F000-memory.dmp

Files

1720-13-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB