Overview

overview

10

Static

static

10

3048-11-0x...ry.exe

windows7-x64

1

3048-11-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    3048-11-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    9fe7a13d2caa6e333cb0cf121b1d7ae0

  • SHA1

    dce173095949b14ff5a479636b4ebf160c829f8b

  • SHA256

    7708e599eb5d13bd8c2808db0b025f38de11ffb7a23e1400bfaffbaa79ca7aed

  • SHA512

    b0bc02dcc386c6259055917ee66c6d2daf3a15ef4660ebded4dd21e86492628f481cf5ddb8dcff32b5b2aab6172e6904651f9a2c7a83165faba7c4f2c0c401b6

  • SSDEEP

    3072:OjBX1EGQqMxf43iWY0x4hLuG55i6Bn+QAQHK4/Cm34lPLQd4ImsfDKT:y22ij0SSG5M6BR7HKu4p0NB

Score
10/10
ratse62formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

se62

Decoy

wkb41961shv.com

bdsxm.com

renovationslandscaping.info

qhsmgysm.com

fetbody.com

injured444.live

teensfeel.us

zi59wp1h.com

dfrtrucking.com

16milevet.com

patternzi.com

homeinsectcontrolpros.com

alcosa-peru.com

rmicompletesolutions.co.za

nnhealthhk.com

fitversus.com

hgxaf155.com

hizlitakibin.com

kjhwbk.top

gokarpemed.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3048-11-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections