Overview

overview

10

Static

static

10

2212-62-0x...ry.exe

windows7-x64

1

2212-62-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2212-62-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    1c079fce4ba76c5c2f9cb59b8e55a28d

  • SHA1

    9654d08c25169decbe4c641df4db4227f6f4ef42

  • SHA256

    5ebe6d80081191b50b3e8bf75af4591d4ce6f459c82738ac24a601b71f712ae4

  • SHA512

    0f310c1bdde996f418321fe727bbabd35062a785756e919c340f6d342847a44c4a22f2fcc7e7270270af0e0b6ca57f02aa6b2e67db3f7042ce95270d0e5c6b8a

  • SSDEEP

    3072:odP3kYwlAZ/9FM3YeVMlApKKoSHVGilO7irGFVpqbvO9HzdsFIUosg/LUe:PGDCYh4KvSHVXvr0EO15sq

Score
10/10
ratns02formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ns02

Decoy

0532fxy.com

amandine-aldo.com

utilehubcom.com

oceanbeachvilla.com

content-key.com

mysticjewelart.com

mejcrew.com

finalwishfoundation.com

pilitalks.com

961securityservices.com

minoque-med.com

g-pmeridiansuitecore.com

afclive2022.com

platinumprimeproperties.com

boutique-short-lets.com

trytoryapp.com

elliottgreenberg.com

chemicahlguys.com

drmarcosaguiarortopedista.com

meidlife.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2212-62-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections