Behavioral task
behavioral1
Sample
1556-70-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1556-70-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1556-70-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
3451ddce4f9c8cc44e2cbd8f29f17f83
-
SHA1
af11d12f1d5187e080941841e7640ec6fd2239e6
-
SHA256
9665208da09f4a2c86aeea3a51669e0eb1fbcc4158e81b14b919f831b3034e7a
-
SHA512
1cf87c3d75ebdd74332b0d56ba6cb6d08e65ccd2f77ed6a33af0ed7ea61c69474d89e3ae517c5e18f8147a668f69424efda9bd5692bc416b958c8912142cc404
-
SSDEEP
3072:foD6wwFdLESbE7q9LdNWeRUCWPjH/30MJkkbJflzoXwUV+cZSCN6DGFm:cwFphXNdzRqb/kwkkb1lKLPZh6DI
Malware Config
Extracted
formbook
txuu
AwmbypIG6yf9QSXz8bWbo7Q=
O7mNfHXyoy2X/gKUjQ==
NzG6BPwup9n2x2Je
scctniJcBYrvRtgAPDs1LCMaQZo=
nsUdCeFhITwvXtyx6Uq8HSUIqt/edFw=
tjs+O5yc8v2l8YI=
CbTC9tgVjuYbML+d4LP3Bg==
dCMN6tLvYJt5kAqbAU7L
XGqrrKSmUYt90qar56Hk5QXEdq/f2HL9
g6Y06HTso7eC752h7jBY5eyu
o9cdHP4/zAPP6o6VPAYtHw==
ucP/7dsFecw6kDkwYDCdJoY6WA==
e58jZkJo/X7yRdSXnx5Y5eyu
/qhz/F6aCks1R+GbAU7L
9oxf0kFp+k03Vh2y4Zw=
w/VmpJjKcwRBW+OipCiv3Ih3WonicVQ=
xeMTEAY66GjU8qGSmg==
j59gVTl2A2YYKJ0=
q0lJAmbqmgNN8AnOGk7IFw==
HK5+/3n61pP2x2Je
CBy2dtwOtDFyi1dU
ACFYXlXGjaV8mSKjrlTc
sTw8Z0t0CYbuO+KbAU7L
YnoJxk/CdfxvEtybAU7L
2U8LeuczogJuF+GbAU7L
devlpymTMntrkvL7S4W1uzqwiQwsmA==
j7ZIc0GXDFywRySjrlTc
/63ZlhE+2Wz2x2Je
XnsHMCRuC1YwVeGin636hLyqXQ==
fw8l3lu0ZOowo1SjrlTc
kDlShF6MJEAnQ+GbAU7L
OdefHnnvzV/S8qGSmg==
7PR6Kp8U63ThNsme0I3N0+rnSmbY
+QebPK0xIGuj/gKUjQ==
AC+IhXWaG3LghmAh9jBY5eyu
S9GKA3XntP2l8YI=
dgIGKBZSu/bo/gKUjQ==
Yf26OqXkWZeH4PWdo4s=
KzfMf/FgHC4SLt13t4U=
SNDQCewcvkyrVisqcB1U6AK3
1RKf4sZKAAPJ53sLSUjGFw==
u8ZP2IsU0eL2x2Je
XQnVTLswFFc1Vd6bhweA0evnSmbY
DcHPjgJiHaDzRRChlSyN5RUEqt/edFw=
TWcDPzV48y5rCuCbAU7L
slFHcmXXqs2r/Q3I9EfJ
EIc/UUmsY84is5Ns6FXbCA==
O0+aqJUHyNK2C9+bAU7L
rmsuPzcr4P2l8YI=
wMo/dGT0pMcSWf2xF+AenbI=
Zf76fNzZeEcf+eNWhrfnJoY6WA==
V/X+pBVdMjweSR2y4Zw=
QMnU8OIikeRIqsKBhw==
0d9+I4358SSDzEwMBpQ=
w+ZyHJEG3nryRx2y4Zw=
okscHhJ6TNJikBRJ
ZQICiLwzGGSjMRPlFlSx7rz3srvf2HL9
bOj4rxtN1Q3t/gKUjQ==
p89ppKTvoCqQ4ZKIv7Wbo7Q=
N9q4M5X+2BLZ4lQZEpjM6UH0oJI=
a/u7R7LoXar6RR2y4Zw=
3HNL4VWDCFxQp2X6PAYtHw==
DB6rXMw8LGY5ReLvYG/7R5KP+zTB
tuWHybdVHC8QZTgkWZ7lJoY6WA==
njclosingdocs.com
Signatures
-
Formbook family
Files
-
1556-70-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ