Behavioral task
behavioral1
Sample
1904-63-0x0000000000400000-0x000000000042B000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1904-63-0x0000000000400000-0x000000000042B000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1904-63-0x0000000000400000-0x000000000042B000-memory.dmp
-
Size
172KB
-
MD5
0059b06ff220572ffd0a80b016b40e5c
-
SHA1
5aeae58542e74f42591bbd4ea1943498cb3e8009
-
SHA256
5692c8fb29dc07f48eb261107208dd413acda3b32e286db953d024aa45d65d14
-
SHA512
6ff57f7a41278bf5d04699453b1d53fc7ad50f4c4f517a189d5765bed2c18bff693f9de6fff86ce1480fe15eccdd988c0975d352ffb79eb5cba7b31b0b1bb0ca
-
SSDEEP
3072:twJNtKkd7XQYdCMWwDgAFGsukONMFbgxQej+sy6s8Hk6fMg+65VZn20:ktKi7AcCogAYcON5xQefnMgPZn
Malware Config
Extracted
formbook
tdet
flecOADaqXPdGREyc2S5U7in
KVyI9ev7H+7QNmD2Ypo=
/dS+buXK9NuzGmk+HDCRUfazFQ==
IHpkgl+nN4I0gAnczMbM7asQ708Cbt0=
UkVGwHvEpCcYba0OBA==
VTsq0ruLmB+azL+lXZkZRw==
5qToiFYvMKMD8W5dGQ==
S4rU9cAx619SvJr10kpU4XCfj6w=
9ymGAMljBH9nres8Ew==
BZeWfy6ACwx4uKkD66doyXuv
prCtFMOp06JaczompuX6D8VIKExtMFEs
dePiDR+zZNPBHPeGJAWv
OAR/oEfQWJ5S4N83XZkZRw==
t3LunnRUcdmGtd0rDg==
YAg6s7KVxrMcXPB/fJQLQQ==
t9oRP+fGiZ5WqdhnAg==
6nyt4oS6VLCeC907L8blYIuxEw==
rzQ6JM4sjRjA+TBcNpQ=
VILmlp6qylo/bMw=
bGqKNd1c+/9ptjYJ6adoyXuv
O7jwIsiapq+YFY3vZHloyXuv
LwTriqCs0LuZDGWGJAWv
Ms7rFApW4DOYva0I6F9zCnoN/k8Cbt0=
sAoMMjajYDAQpyuG99t1YIuxEw==
XmCJKuGsrCLJ1N0CMoU=
Q/YgFOQ2tIQ7y1WnIIjuS/Xqiao=
KSAu37WVuTuj3isSFTDRfnCfj6w=
tTIH9cMJkOO4LAnbXN7jYIuxEw==
W1JW8f3xIguvukcr
Xu0m2qK408ahDGCGJAWv
hhlSji7297cVQKv4nV1hVHGp
5p3XwKX6pxB4mHVUnfEUch2hiKQ=
ioqH86s20T/4C2GGJAWv
n+Ra04JUUrOh0rwaDA==
fGg3VRdo7zbeAc80XZkZRw==
2RCDtqD4fm3J8scJ7atoyXuv
1RZNdAf5JhPF8NukXZkZRw==
Qq2x2uZK1iV/ztWlXZkZRw==
V2CKQuc+51C1+mWfGYCQUQQ/JkEob9U=
t6eXekJMaexLcsALxa5PUA==
y8qewnpWaEio5MIdIN51YIuxEw==
jMMCJuc4s5dJuxLlzSwR1Tk=
WO4AHhqhPjuh8jRNKQSt
ogU8qK2VqrOvIiD9W53VDPN0obSW
jBwhRCRs+Ej2KPnkYuZtYIuxEw==
Roz5bCfAbYotd9c=
McHwEbkYws5IZrCJZhWqwW9qCl7SkA==
90VOd0hrT02y
vCJl1Ma24bZj4Ge/QoOORqMD7E8Cbt0=
NZSJqbtKAIJ20qPy9ct1YIuxEw==
wprAqTbNOM9+9A==
Z/YfPSGMEHEeQSF8OtNwf1oQAZcG+/9MIg==
D4C87o9mhXLaFdSpXZkZRw==
29DIQgn1+VzKtd0rDg==
ZQMYPC509DTaSjPCYAym
YpwVPj+hHXEbQhChVg/gqX0yGw==
XPgLKCCBJbacDO86XZkZRw==
ZNrYPg2oPCCGo7jn442cTw==
ytDYfoAXbE2v
yqacRiUJOd4OetU=
k8w84M6YlYChm+9YGW0cTQ==
9PX0YD8lIbAaZHNMpiTwpyA=
gI2SCM6/7Y6wBijLESpTdDE=
ntAQZ0eLI0s9aUuwjBmL/I3MN01tMFEs
posycbd.com
Signatures
-
Formbook family
Files
-
1904-63-0x0000000000400000-0x000000000042B000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ