Behavioral task
behavioral1
Sample
1500-59-0x00000000002E0000-0x000000000030F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1500-59-0x00000000002E0000-0x000000000030F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1500-59-0x00000000002E0000-0x000000000030F000-memory.dmp
-
Size
188KB
-
MD5
42d0ae823858383ed4511ce1ca80c89e
-
SHA1
0229add781e5e9e7f18a56f6aa8ebc5e9f3c75e2
-
SHA256
75a98dad3444a4daec892a5c5307a357d02aa8cc8f1d78a48608cdd642bc164e
-
SHA512
67b20ee783f4b4eda9abe5a4cc6fae7ce904578b4a99fbd85506310a0d4667fbcf52962a65a298370be21085a75d72a3849f3adc6d6d56753f45ceeb7c3a0faf
-
SSDEEP
3072:WksKHeq9X93CFtWlzS46EZt0fTWb65kjj203eF9u++m8K+SkdAISle:cR6ZCFc+EvgSbikjj203ku++mHCdA7
Malware Config
Extracted
formbook
q4k5
jQYgo8tIgmIc0mvpRb5x
WvKdh53xC7N4gDV7C595
3NZvdu4YVUEvB7v2l0Tm0SVv
/VRXhfIvRiNV3GOoZZPqieXuTd/oHzo=
iVrRnM8RfE8pow==
p7pocu0vag2HQeAi1Q==
jE3wz8cIIck7DaIRQns7/WM=
idYEkVhfx4USLm44
xQpoZwWMqZQZ0b+uff0=
1u0SiknP4Ls7GLQCxkszuinYzQ==
AVuV9lyovZ0am5kw6fg=
KicecBSZtmieUd7hkUDm0SVv
pMHRHY3n/dVlLQxECMx3
dE8S684NNa9pRNo=
2WKRICBuhDoNkuozMWGBGWPpliRqjw==
UnIpN/4ONxpFwu04CF57Ew==
lzTU5CR1jj6os+3Myg==
WR8IgU/HRPwvtA==
eACJW4jpYgiATdg=
BRYZUYK51HygS5kw6fg=
LCy5lutRkm/boz63mHIT7Bdp
OqnALPb+Yxrj
H7Ao9RaCr44SLm44
TdNqd8EUIQrVcJbmqns7/WM=
Ovh7T2DAyzk9G2c6
qHIM8wdzl2to+B9TLJbmqg/UzQ==
H7pNFDCV1ui2htKxcwbJnejwTd/oHzo=
vNT0V7UQMPRcGsM27gaYnNIT0g==
sulKq9weiSt0Hw5LcgU76gziliRqjw==
1i43j3PZBtqpen2SMLdz
xgX+Ty6gxXwgxm7pRb5x
dZW4RxqC4FRKvg==
nW0wETKj1MCEU/pDCF57Ew==
nVPCqNIVLga9Qkoq6opYA1Jc+wxo
NzRD0pr2N+UgpP49
b36rGb4ZWFA3y9zpRb5x
MfSCS2TYC/JySlsy
zQoyun3TCevkZrANJGb0qcYLERg=
2425INnkRPwvtA==
ol/Wnt1Jd3ItttLpRb5x
icUqei5ulVPrZ6L8t4xXF2tfq9bzUTqO
CkFeyHPpBuUbtPc/CF57Ew==
pzjDkYLH/O5ySlsy
KQa3w5OIQq9pRNo=
grzaa1nD9enouEzpqsRm
ZwSafJT5CO7mpC1gCMHReNKBi+VCthwmvg==
kMhzfwEvQfGqmTgv
ucrZKckZL9WDHjoOxCNQ+3Q=
LP6rl+oWWU8/EVIbqT5lFnJhrtfzUTqO
mvISpafy+9fLbHdC5Grm0SVv
UvqttwVjoo8H2xbmNLV5BA==
sz/iv8A4bS/jgJBiZmVlLIjzW2p3+R+E
jIiL+ZT5PCRYCK8saSbCuSSOAQ1g
FtWAh9IfPCayN3bZpXs7/WM=
1iNCt2Owt4vAfsLM738660xc+wxo
ZrC6CvFpxFdKtg==
rUHmxsf+Yxrj
Vy7Kg3zD6MuPMWjH93Lwp8YLERg=
vnsaLokBOjDaXpjzrHs7/WM=
+ZTHTkqDnQvEOllP739xDQ==
S2aA6IL1Ixx9PvN0xdqFRY+lpt/oHzo=
nKJEMVCmv3knrcJBGa1pKWs=
Dd7SLM9GsFSeMTwX1Q==
u3f82UW79J1PGrwW2A==
4222e.com
Signatures
-
Formbook family
Files
-
1500-59-0x00000000002E0000-0x000000000030F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ