formbook | 2240-13-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

2240-13-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

431ae5ab8158b9a130a5c4e5cef0bab6
SHA1

cfa903c1e86583b846045cb81d5ccb0d2f466d10
SHA256

0f5af67a18bb9c8ff2be98cc1a99ed0833ccb30ef7f2f31c64dcb45200d2d157
SHA512

70b56e8b43ad8dab3ace58f07d6dae174b45c761609905e649d25ac2b2a262736f6463e651b064681a9b8e7daf77c4a2992ac9d368db06d5a1c2f7bb29454b10
SSDEEP

3072:hVdNTk34GsQNYF3xXfg5IKC8Gz6qUOX/IjbPpr0PVtQlP/oY2QZi:u45pxvlKOz6qUOX/obBYPYPZ

Score

10^/10

rat de94 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de94

Decoy

way2future.net

worldnewsdailys.online

rendamaisbr.com

s485.icu

vcxwpo.xyz

imagivilleartists.com

herbatyorganics.com

xn--80ado1abokv5d.xn--p1acf

invigoratewell.com

especialistaleitura.online

pkrstg.com

performacaretechnical.com

dreamgame55.net

hkitgugx.xyz

istanlikbilgiler.click

slotter99j.vip

exploringtheoutdoors.net

triberoots.com

energiaslotsbet.com

dkforcm.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2240-13-0x0000000000400000-0x000000000042F000-memory.dmp

Files

2240-13-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB