Behavioral task
behavioral1
Sample
396-138-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
396-138-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
396-138-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
5421f3a5f374118f123d15e1e2e06c1d
-
SHA1
37c98b364390a05b73648c012116f5b1a3b2a315
-
SHA256
f5b393ff6f36475cfe0a0b8ad2a922eb9c8aade8c5376d987b665d002938e875
-
SHA512
c6ed602bf3c686effc9441cb703717252d8b162119f285b8f7bd759d9d3233cbadf26a21a79ca64025a462beaa70280d8d7f108290ac5e8dfde35c0f9f2535a2
-
SSDEEP
3072:8lvHHlDjMg6DU6eGyNW4bBSV1ax3Zeuf6Gy1TixRoIORBNpDuOy1QL:ClD6UDGylbGahZJe1TixRoIORr0u
Malware Config
Extracted
formbook
fqsu
AkyeqShCalEmdx4Pny7FuCYHBg==
wQHhhX+wpntbieTYx5SDL1I=
wQn2vnyjsr2ytKVPPayZ/q76TsGEjjc=
qjaLXZe+V1elnxHTybtjN98FScGEjjc=
gLQJG6vc9qoMNQr0nJP5rw==
40uYYgsqHZR3YYQ=
yQzujEiwQfI9aUMWeZSDL1I=
a5RXF+r4eOxJDuJZWtmo
6NTywf84tXKqmRLjnJP5rw==
i90kHiJe7LodeKeXBL/CBHU5bqY=
mgVWKGSRLDOCqAby0g==
R4OqMF+ORkum8Cfgyw==
YMsk+6LdGYgIDQ==
oeg8HlyEBvw7tYtu
42KiPz56dXSD22oIAYk=
1WS7l83tLvRpWgHznJP5rw==
GEwt/DVc/fw7tYtu
SrUY/StaAe5Ru7d366lJKdU5UcGEjjc=
L5X+L+4bOSjm2MOIzTPagzTf
MJj3+Pwhr2xWVp5MwiM8pw==
8jiTk3+0WyQsY61wTekTuCYHBg==
ug7wj4q7XgTgy+jkKZMHmEIAOs4LDA==
5PzFU0R0VNHfhJl3
MApv9UKZj57d
+E049azX5tuv1RDQxJSDL1I=
2iRf38NYP9RIhDob14pyaEEBEQ==
hPrtotX9kFUCCw==
VuZDO7z8dmKw8Cfgyw==
t6b7YmP5XFTK
Y7L+EpjN8qYGJgPqYQTagzTf
RKzltQASJN0nRn15
bJJrG9X2lwUkP4s=
0CnCYJLCYjg5UV4BlSu/
r9MOEAs0szv6Wv/Fww==
a4VrJ0ZtEAc7tYtu
yfNAIdwMHQsXYb+bcOsOt+N2fcGEjjc=
MrP8hW2SwMbOLQv0/o/CBXU5bqY=
DEiHU3WmJOGvCSAKjYE=
rdSxgzlYeHRY8Cfgyw==
p9ofCUN2+M9Ohlk8pSrVoEcvd+CMBA==
oezGgn3MGYgIDQ==
ih+IOeMdoKYMNQr0nJP5rw==
JoZi7CaKnpaa4WoIAYk=
pQVaV8HuJO1tqAby0g==
gQJpcvgXRCCVkw/inJP5rw==
Rcwt9ZzaGYgIDQ==
THpkQY6yGYT1Bw==
ZqD1+4SvzOr3CRweny7CuCYHBg==
M3dmNoyt1Z4pgsiUlHSxM0w=
gK+MUBMqv4eemrGcDNnWBHU5bqY=
/UQbzgw0vMJcrbZQxY7rqQ==
WbOVQ4/iot47tYtu
pSmNlRpObRqvyTYcXg/agzTf
zQVOJ0thiC2cohHdqkG7uCYHBg==
Ay4AnBowMQDuVOzguCMTknU5bqY=
wkyjZ6XKGYgIDQ==
JLgpPbbUGYgIDQ==
L1ZIGOEEmQUkP4s=
h9zPl0B2sci03GoIAYk=
Ln7TCND7/PLsG0QEolF1sFo=
EnPR6K1D7asIEA==
60KnuSlIbjGvsTEdXg/agzTf
nv1JRLHSGYgIDQ==
7zuGaKPFGYgIDQ==
newallsum.com
Signatures
-
Formbook family
Files
-
396-138-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ