Behavioral task
behavioral1
Sample
1268-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1268-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1268-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
179a21efaccac8949dfe521366a42d66
-
SHA1
c6ade6279570c5f3473e10a164afb9389b4a451f
-
SHA256
321ed8d0da7fced9e7347e16f4a00c72bcaba9176ba0662c02d524b11be20adc
-
SHA512
343c8bfc7749fd447eab1ea7357a3d186914af6348669e5f0d7eaaaced5d19f3f6aebaf9e46ddd2caec81bf7789b2f8598e41a2f9df39bcfb302547f2f9f00e7
-
SSDEEP
3072:SfieHHi/GLvscrEweuYtWEQyssW4d/scmoh6s4cZmNa2o2yHzORsC:iji/ZseuYxLXZwU6TcP2wzOR
Malware Config
Extracted
formbook
gvft
NmPFwnjoIfdbuRAJwCBKN0hhTA==
ljEZ4FN9w0tnyaMQBg==
kJPYpDiKnF2On0F8Dg==
rUs2zni5/8mrvWV30gwfyiJGRA==
ZGmuoIugtVWlkowQK0BdSw==
K0W+1qAuipjzFdUQuAri
HOZSRcPpQyGfkaHX2hTj
J+0371uUjSaHn0F8Dg==
bAVUSM3sENhdgzlxBA==
HECYwcKVKMZbOA==
L+esafhGTuIKOo8T1Qa5P/Ei7tXw2OdpYA==
Is22TfM6JNAqmAxeK0BdSw==
AtMhHLwOEZ/LK6HX2hTj
8Ql3j17yRwcXQhM=
vsoZDMAjJbGNf/F1YNRoCYCa
Nj2ytGHKKMZbOA==
N8DmKM4IA5f50JcWEXJ684nimeSB2OdpYA==
pFdTMc0dKO5MtHaygQQ4Qw==
rdskCcIqRg/wTF5a/mo=
96n0+bQmSRsFnids+1jUnE6D
py0J5HKa16J2qowQK0BdSw==
cDwo7WGDu7kW6uAKqA0XyiJGRA==
bwnsqB1TPgILQl5a/mo=
dDqgoDuJhzmc9FTEjwIayiJGRA==
GZZw9N6bKMZbOA==
0N5AQ83oQAcXQhM=
9bP9+spSdTKE4muYF2DUnE6D
UeHf3IXSyowZWb80Lo0rQWd5f/Rbu5yH
eSEIupcWNuw4ctRQNnGP8HGY
yc0lQq7g0oOgRL9E
zOkuCJ7oNTPQNBSKJGM=
OfXVoiuBm2hLp6EXBHjMwa0YzLY=
IuSsXUWH9vwLPQ==
Zn3DiiBtz9k5b8HulBQVkjhaG4qf1w==
4oJoEN49qb1RwkzCb8JoCYCa
dy8K4HBq8T6gRL9E
0PdbUPk/K+4L7UF7ohnp
Xn3MloAIGJzv3NsXmusF2dHur2qy3Q==
TvjihEqqEeUJ5WCgH2I=
EpnNxnnyPgcXQhM=
VA3ckXnz94NYkGakLpZT3Ja7cN8RRbQ=
1OU2FaHbyYz2XuRgSspoCYCa
Ch1qb0HTaCz+MxE=
BgNbRwuTuZGpml5a/mo=
5X3GpqRVwx70LBWMXINDP2g=
cwv0pl+9vE8jTV5a/mo=
66/s7JXa1GEJZthM
KkGTcv9PRwbzVEaM/kPXNLTam0Ta
IMH60ktrp2w0n0F8Dg==
VPhDB9+XKMZbOA==
PtPbDyMZl3DP
Te0+Px0dE9FFm1SSFw==
LDcw5bs2UhqllJG1V1FnUg==
XhVqR9oeFOLFHxeLl9ebXA==
/soaBrEdVC6DzxdbK0BdSw==
iScOnz+B3fEESjRkK0BdSw==
JUOOSLXdOTZWeFiFDA==
fTyMZd3+QTwiCI3EMn4ek0xdG4qf1w==
4Qlwh2HWPkJMkHDwxQodyiJGRA==
VC8buXsZCZBiOI7X2hTj
fy0QvidBZR9zzy0r8EVcSQ==
SvFAUAVKOviGn0F8Dg==
5bkjFcU0WT6Z3z1uDYu1s8jur2qy3Q==
Rle1sGLL0V26onv5j95oCYCa
realmen.uk
Signatures
-
Formbook family
Files
-
1268-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ