Behavioral task
behavioral1
Sample
944-60-0x0000000000C30000-0x0000000000C5F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
944-60-0x0000000000C30000-0x0000000000C5F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
944-60-0x0000000000C30000-0x0000000000C5F000-memory.dmp
-
Size
188KB
-
MD5
24b1b6d86dee370e332f474cf6a914d1
-
SHA1
bb812e85075c5e223f4942f095e9c51f3a5b7760
-
SHA256
7e6237131903d009899f26de96fa8f26a06c18c9449627f63ec681baa3995205
-
SHA512
7a7deb6534226bbf06f20b65888ff86b42033725124e5923a1c3f7703ccf80cc6badc141eb61a1773a437ab81e33f1f7eba22b33490ca6d88771339eb7b12f31
-
SSDEEP
3072:RksKHeq9X93CFtWlzS46EZt0fTWb65kjj203eF9u++m8J+SkdAISle:1R6ZCFc+EvgSbikjj203ku++m4CdA7
Malware Config
Extracted
formbook
q4k5
jQYgo8tIgmIc0mvpRb5x
WvKdh53xC7N4gDV7C595
3NZvdu4YVUEvB7v2l0Tm0SVv
/VRXhfIvRiNV3GOoZZPqieXuTd/oHzo=
iVrRnM8RfE8pow==
p7pocu0vag2HQeAi1Q==
jE3wz8cIIck7DaIRQns7/WM=
idYEkVhfx4USLm44
xQpoZwWMqZQZ0b+uff0=
1u0SiknP4Ls7GLQCxkszuinYzQ==
AVuV9lyovZ0am5kw6fg=
KicecBSZtmieUd7hkUDm0SVv
pMHRHY3n/dVlLQxECMx3
dE8S684NNa9pRNo=
2WKRICBuhDoNkuozMWGBGWPpliRqjw==
UnIpN/4ONxpFwu04CF57Ew==
lzTU5CR1jj6os+3Myg==
WR8IgU/HRPwvtA==
eACJW4jpYgiATdg=
BRYZUYK51HygS5kw6fg=
LCy5lutRkm/boz63mHIT7Bdp
OqnALPb+Yxrj
H7Ao9RaCr44SLm44
TdNqd8EUIQrVcJbmqns7/WM=
Ovh7T2DAyzk9G2c6
qHIM8wdzl2to+B9TLJbmqg/UzQ==
H7pNFDCV1ui2htKxcwbJnejwTd/oHzo=
vNT0V7UQMPRcGsM27gaYnNIT0g==
sulKq9weiSt0Hw5LcgU76gziliRqjw==
1i43j3PZBtqpen2SMLdz
xgX+Ty6gxXwgxm7pRb5x
dZW4RxqC4FRKvg==
nW0wETKj1MCEU/pDCF57Ew==
nVPCqNIVLga9Qkoq6opYA1Jc+wxo
NzRD0pr2N+UgpP49
b36rGb4ZWFA3y9zpRb5x
MfSCS2TYC/JySlsy
zQoyun3TCevkZrANJGb0qcYLERg=
2425INnkRPwvtA==
ol/Wnt1Jd3ItttLpRb5x
icUqei5ulVPrZ6L8t4xXF2tfq9bzUTqO
CkFeyHPpBuUbtPc/CF57Ew==
pzjDkYLH/O5ySlsy
KQa3w5OIQq9pRNo=
grzaa1nD9enouEzpqsRm
ZwSafJT5CO7mpC1gCMHReNKBi+VCthwmvg==
kMhzfwEvQfGqmTgv
ucrZKckZL9WDHjoOxCNQ+3Q=
LP6rl+oWWU8/EVIbqT5lFnJhrtfzUTqO
mvISpafy+9fLbHdC5Grm0SVv
UvqttwVjoo8H2xbmNLV5BA==
sz/iv8A4bS/jgJBiZmVlLIjzW2p3+R+E
jIiL+ZT5PCRYCK8saSbCuSSOAQ1g
FtWAh9IfPCayN3bZpXs7/WM=
1iNCt2Owt4vAfsLM738660xc+wxo
ZrC6CvFpxFdKtg==
rUHmxsf+Yxrj
Vy7Kg3zD6MuPMWjH93Lwp8YLERg=
vnsaLokBOjDaXpjzrHs7/WM=
+ZTHTkqDnQvEOllP739xDQ==
S2aA6IL1Ixx9PvN0xdqFRY+lpt/oHzo=
nKJEMVCmv3knrcJBGa1pKWs=
Dd7SLM9GsFSeMTwX1Q==
u3f82UW79J1PGrwW2A==
4222e.com
Signatures
-
Formbook family
Files
-
944-60-0x0000000000C30000-0x0000000000C5F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ