Behavioral task
behavioral1
Sample
1880-75-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1880-75-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1880-75-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
93eea5a0ef8598717ee91f20899e9dda
-
SHA1
4029f13111f184016da5cccbb5c9416bba7cdccd
-
SHA256
7d1cb6ae38cc2a746ea9024f003cb8ecfa52ebe1cbb3e6afc0ee2c8050443047
-
SHA512
15c37e08f644b23b69d9787b44077c05f5abd1588fa03a75cbd0905883030bdb21e847ae68922cdc2e48a4610345bad39f1cbf0e9918233aaa0feee8080ba3b5
-
SSDEEP
3072:mMCndzAAnz6D4YGjHyNW4S2iQw54qj0fyq5F6pMa9bOq1ppNHB7DoVlCXSSJ/Je:mBdcge4njHylSB5vjGyqP2M6bv1TNHB8
Malware Config
Extracted
formbook
an3u
JFaJeVUsxiAme4+yNP3euJ8=
eLonTcsoXIOx7P3ENq8=
K1CrFN9snXjtlSXZ83V8QA==
xFQzkItxQ5O+1AeGCI7FwAhtrp4=
kMb9AtciyFWXMN5m152mnZU=
TH7pUBWylyZyKFZmZHy6Xg==
HFKTydcpHWZuik5jZHy6Xg==
By9eyjcb1/YesbveTMsEBERwhIc=
dITE9YUbxjuAIYkTBddf7ReXsusk
f8w6CNG4Wdn2A0GAS9JS+kWiq+xUqyo=
n88iYi2DqTx4tYRBc0ra
hK7psYqPJ0B0o/FBc0ra
n+RQbzfC6jI0aPKXYfonFERwhIc=
91K4+8kgN6cJkvpBc0ra
ugaE97lGa6MNqDbejwswF0RwhIc=
GlzEiQBngKfN/VcEskh5GTaKRQ==
9nNHvH3LsRMg
D0On57NFkx9lsIRBc0ra
6xZNkWT3VP6O4/ofX+jvnvxkmY0=
p7jgyZlyBnejObQo115rqkRwhIc=
jLQl11MyDA+KQw==
lqDN1WPMBi9lp51yJbI=
JnngOfOJreQzHW76
1Bpgm7EGJ5H8lPlBc0ra
h7YbBQbnfmzgI14=
BjqlNLJ+Yt33Mbs563F2rkRwhIc=
BT6VFJe0DUZMWK6o5Q==
J06JX99yLI95nJ1yJbI=
7hxZ07AECF92m6t+dkvY
o8XZTkfYz0qWSVVUrXViqQaOJY8=
QnjY0EmWCne1YA6X1MdsSQ==
0uEI8mrU8S+qZ/BBc0ra
FkK0YzqatyxrqWY91EzN
DyphE6Sq30I6hQqcfHm1bog=
lKza/7sfQ6HLoQDF/Q==
jqUAPQaj3f4ydrZfJv3euJ8=
C1PD2WjB3yc0hfpBc0ra
X3vd0Z+olG60Wg==
1gZpI925muUivFY=
sNg9JvX572ycwn12YeDhnrsA
lNwGV0b3f2zgI14=
VmierTieveszHW76
c6kUUwNtj9bIEZImQM3ua36EptEz/bdY
aITiyYpwE4THGVDsnSFCHERwhIc=
eoesF+VBc+VPx4RBc0ra
xfRXSyk8N7kzHW76
q986sjUTt+RQOuTZCJy0IEiIxs4GUEJw/Q==
f7LkkE1YDGbeWK6o5Q==
c5sFzIlf9X63TJ1yJbI=
FCBeVygTxy0iL1f6w8X1ytoI
mcIkCMzUblaSvhCU7Q==
dB1BP/JRO4LP0ETj
g/Yg+YArxVOU4qNQKbc=
2OoTxF47DA+KQw==
9jmvdjdG+VVgNrxsKro=
G2bUkVhyL4N7nZ1yJbI=
XYz6X/hZeKOXv4lBc0ra
OU6Allu91zgs+gI2VNzhnrsA
mLD+C9Flj2zgI14=
ABkQ3V80LbUzHW76
dKX4tedHIbLlG+/y
ttgPy3GAuEyLx4pBc0ra
ye0sa9nEvzm/Bjjt
rORFi2mDo+4zHW76
gotaeficaz.online
Signatures
-
Formbook family
Files
-
1880-75-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ