Behavioral task
behavioral1
Sample
944-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
944-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
944-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
e4bfe1519fbdf32acb5700577bd1d7b2
-
SHA1
ec84b608b3482a2931b2da89d0e6eca4a7450c49
-
SHA256
5015cfd4bda617d64a3c66092e6f4fd52446287ace2f7be7987ac0f160f4306a
-
SHA512
c5cb4b52ac71a041f63431661aef0b22e19423cdaf44a652a0abfb519a5be6b24e33b1b9e31c90c87ba4a17a98dba1fabe40bb5a8c7b3e608dfeb141c152c45c
-
SSDEEP
3072:CqqHiUNIwSGfYgFtWBD8CdJ18kULzNlIqiP9X+3oCh81ORbpeIuIsRXIbyIHz99l:T/UNnSYJFwDf11ARlIBZ+37hTRDuIOXU
Malware Config
Extracted
formbook
cihc
qFo4ml9YxRvw7XJ4jwPg5Vrv
wKqUISKQk/h4B9evKNz1Rag7Z7EgiHw=
+NzyuIbTL2ZVb4dzHAA=
BNZCU0540B+kTPyMC/bFDVg=
rwbJdkCA7Uc9TcOoo2X7eQ==
oAh101+lA3Q=
VwJjn27I3gHe
TAIDv4rbL3xwTFZkHA==
1r+rWjBnxyLaUwbi3MBVqJa3/Bu4rQ==
RbbFy144lOXd9XuUlRltj6+NnQd2
4o3TyNEzkcqy07tdKo0t
hOq7j5zjULuckHJRFg==
0moD2uAqqhHD+6EC
xoSQokh7V6gOnIdzHAA=
7uJnx9IJ6Tuk5e38zNz3xN7lDQ==
4Jz4HegpC0SyTQscZhc=
nAyZHbSOfNtR/ZAr81oJbg==
lQJhyXZecdnX8bGVCPbFDVg=
RRzzgpYE91w2MBs2Q5wv
jEqb9vFEMWeCEwscZhc=
8+EYWebr3hAfGpSd2f/y+H0jGg==
fGFAysw5UqIKTFZkHA==
1K2GTcnL0zK+Qcyoo2X7eQ==
BNLv9omM/FtSfSj4vAXg5Vrv
5pTzLfxpdeFqFAPZo2X7eQ==
4D6Sw3uucYqoyq0K
ph0bBgNY9VHSQP7Yo2X7eQ==
dypycGy5GVDwbAzYrSXHxN7lDQ==
yzicAPdYWrkv5rRdKo0t
JAzpkksY4SiA+mvKFvbFDVg=
WOd/9QyHe9Vfv6QI
shmnJMm4k+dd6mPqe0pdoq17uUg=
aSChFRCHoAiCLA7ao2X7eQ==
MpTzRubRtf5I55vs/XFAEGT2
nEAHqHe4HGSqTQscZhc=
IAFhY2jMasFfv6QI
e2LuKuQf50g6QRF1igLg5Vrv
TULcH97PQapfv6QI
p1YorK71wRL08pz4HpguR574T2h+
NOposGk2qRIODbsYJXsOTi74T2h+
Tf1eYvbQPKSAfghdKo0t
XQwDwYO8G4d5TFZkHA==
KtU7QT53rxTTYO4f
Q+B5RRoJPHnyfAJajR8=
J9e3aCX01Du3CLoSWw4=
nglVed31dtWw07tdKo0t
J9e3bD8zOqcdyljuh1VhoK17uUg=
wJn3BwFN3u/e8Q==
Btzu4egfabqaviyNtCG2+9r4ZFrCtA==
ppK17qWK5DEODYaYrgjg5Vrv
FtmMLvLKoQ+AAIrnGvbFDVg=
g+79GDaD1e7TYO4f
hmI50o9mWqORr31c/xMyQxs/aLEgiHw=
LOjEqkx/W5LnWwscZhc=
knpk8IFYWawGTFZkHA==
55bi/s2yGYNtnmBGwXWI1RZw8010
f+7Ql1s+O5HdXNg2fQPg5Vrv
3MKiBtPOWsFfv6QI
ppb0FOIpAXFWjmV8RjdGja17uUg=
CLqOIDWvOH4=
013nKlzJF1x9cgSIGQ==
G35cMobMUapfv6QI
PLI8x98uEFS2U957A/bFDVg=
txyD3r2qA33fgw6hC5erQKH4T2h+
digitalcurrencies-fr.site
Signatures
-
Formbook family
Files
-
944-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ