Behavioral task
behavioral1
Sample
1500-63-0x0000000000400000-0x000000000042B000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1500-63-0x0000000000400000-0x000000000042B000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1500-63-0x0000000000400000-0x000000000042B000-memory.dmp
-
Size
172KB
-
MD5
45846a6a3544b891817223383d8bba75
-
SHA1
ba1be2be64fb8313982cdef4306736cb67d412fb
-
SHA256
53f3197867c129101ddd4384c10df96fed8cadf69be4fe8d668f01e6eaefcdcc
-
SHA512
32d8ae1753cccea9d83cc8b1172efdf02a63d6dd3f9200f03e88bb72f164f257db759dc38304c8f96d49fbf22a7983e1d79238a16709e74accc6b37a770c51ae
-
SSDEEP
3072:E7/fc0o+e+ntyWAzxr/fj8WeSEBbGBjxw+zSEe:McX0tKxrnoWejBbGn3W
Malware Config
Extracted
formbook
rnsg
H3Gm6TGws1TVcwMVSHH2yQ==
nAROh8fzxgckN7s=
LRKSM679V29ecChm6Vo=
WOImeXnJHySWHOQQ5XDxoHr3cA8=
RDZbk74kMcP/ixMCBzQ1Cqt5
Am+c/TvOw0nFJ/6yCn9qr5c=
Bne0fMM8xr4igFNJGw==
IpYjLTyNS7KXtku5MYXx+IQ=
EIQKGSdbEaL6pztR6wZE
OI5Ne/Y/hQZa
j/uLneVDjaicpB+SDqCgb890s4k0
gug4b9AK0nfIa+rs9XsUn6Nbfw==
ZL/EOPIeG8lS
52ne6SGiQFxAFCM8EQ==
n9YimSgka3Y=
8FMiRc6m4gckN7s=
Kwl19y68k2CoRdvcrgp5wD0tKPd0sg==
90aNZ2asfS8tQc1Q2VRRH4U3qoqErAs=
F/A78SCVJUK3FCM8EQ==
Y8g+T6nt6yBk+2PEHUp8ZEbfXvXoug==
DwJqAjBEmpB9kl93iIwA0A==
EobCFx9mM9JbvHt3WbJM
9ljc6g83eGayFCM8EQ==
wcxFyf+MnCqSIuVR6wZE
k9YLQnHe0oQMXR0mGppNgyX+G6ZMpg==
fwJl8hmelDCuLO5YiIwA0A==
iX7Ei9RS4BoNMPOW/yFULp0=
uS1/uy6KWPReBt8P7dUr5Io=
vq4cqNwLwT2ID4yOZ7Abn6Nbfw==
PMo5v+pkbP5Z+YtwRMY1Cqt5
ffJvhL/kMT66Nu9R6wZE
yLvotbH0sVRNWShm6Vo=
82i0AY3L1xOLPaw=
GPgz6yaaKCwNNQTAiIwA0A==
6+Bo+wEzA5Onng0p
vTe60eUNa2syQxPRP4Xx+IQ=
kwiNgYMiMtE4v1vjTo5xqUItKPd0sg==
mJAVpNlXS9k8uzlR6wZE
j37oXYsRF89S5bPn7z0zkIVErYqErAs=
X75KRzozOuJH
KowaNGn3iYpVdwEhFj9uFzrPZQU=
oftJhLEcI4tmbUAnSWzpLJs=
bzhwLngOntbFzUqyATQ1Cqt5
E/uLnMut5QckN7s=
JpSqdLLXIzquFCM8EQ==
I5ocFkioK/HW7dKN4lZuQAG9d4qErAs=
ST7DQXYA/qMiy1X1c7Mcn6Nbfw==
H5gXJTBmJM44zqUx5xNO
k4Kx/UOvuCLrzNt4DgBC
spbfpfFzETGuFCM8EQ==
uz63Ny1dN+53FZDMkxpdYi0Ydw==
dtI7MmO/CyYANw04EDA1Cqt5
el/0c3rKpGnwl2W9V7NN
SUSZa9oT43HPZVHwV73i7XMzqIqErAs=
/WGWXac1urB/ny2P8x/i2jLc/6Q+
AHKhbrc2w9Cxz1SuF1kbC41IbIqErAs=
mHin5ReIiT17TRs+
+/AnfbjQMgckN7s=
nZUTj5Y8vPT59sv30yuwg1c5poqErAs=
rxoxj7s2M68PjSCZ10myN2M+dQ==
Sabrxby2ZRpzFCM8EQ==
QRidJSpaN+FC/NOPzBYFSSH8n4qErAs=
QaHkM4EEIcDB7K7o/CFULp0=
ANoEU3j4FMnhCpcQk6cpgieyXwM=
nativepunks.com
Signatures
-
Formbook family
Files
-
1500-63-0x0000000000400000-0x000000000042B000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ