Behavioral task
behavioral1
Sample
4304-140-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4304-140-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4304-140-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
8b0981dd2c5a5863920de3144b2b7d00
-
SHA1
ae1fddae036a243bd10206ed61865fc76881bacb
-
SHA256
90762cac7437d8a74b0984974473df9efb35e6bc5520159797688f77ad2cb7b4
-
SHA512
97ce42e530904550e7ed85daf9f687cd6cc54a95a98142a1d9ef97bea379478650d365842eb87bcc01fd364fc8123147e615f23b288c9c91e67193c6439c2b8b
-
SSDEEP
3072:Rjo98T3VVwf5c0KLuW8rjv08kgylfTmVitrUaGYtFU7jLfqfOm8MdBV0OMED:R9T3VV2ejLM85gqfTmitr9GYrU7j2pBb
Malware Config
Extracted
formbook
g9mh
4FLmbLGs8KgXVPEBSG5LoF7UXz3lfaIT
hMd9HmuA7uhbWu+ExWT/Ia7h0leQAA==
hvywa+j0gCSWeEl8/5SCk1/cZUg=
4VuAMZfGHQB/wJQxxdzCPybrtlOtCg==
yTLPatncNxqfsIXlL+Y=
aKMy1iqbt6eSKPMBBhb2BzDu
93ibUJpzdVcrqYEQTg==
furwotrEMOTuwJLKZfHZdePk0leQAA==
WMzHYMPznGEw5w==
bKEyziAto1pMBZ6G2rgqMKLVjQ==
Ut6CPK8WRPYm8A==
gb/v0uoxQzM+5LEkDxyt
tvAbwklM1sD884YM9vNx4g==
tu9sHX5w/PU+RhnO/7J6/aVcI0E=
2R4/6lekjG6YW/DaGSr2BzDu
kMBZAHKiCrfRoELQ7V9dsXA=
CpMjwPk5KwtSaDJ0tFq6
ceYJq+3JpYh0/5N4iaNSoeDk0leQAA==
we4Pqv1059Ktbg2fooxz9Q==
hOwcoBBmXFReYIXlL+Y=
CZbQc7sarqIZ+IkhTsiZ3qTUhQ==
oMTjnQF168hJIPIl
pBIazgXuRf1FXCgyooxz9Q==
MJxA7T5wRihufVwQ9vNx4g==
qRT9hd0ISAKIxFTUh7KTGNeovDUXJ3sUaA==
Pn8R7+46HA==
Ik/shbvn8swm9Q==
ySywSXFbLaGgG4ISTw==
RouiSboS9aSTE/SEwG7y/Q==
pBYw5kRY1sTyxI2jKLaa3qTUhQ==
DjKzeLKurk1nJps=
R4gsxiJm695rgBWx86Zy7uaUOecNWqIb
reNeBEKHZTxfF6y3Yfnea87JYxwAWWH1YA==
wSpL4x31x56SJsbKTtKe3qTUhQ==
NGYW5ipAJPjSXUEdZ2Fx8w==
FlI/1ihyx40E28BX8O4=
D4aVRKG+nO3qtYqPRw==
9XKqW8TCppZJIPIl
uyzJeNAaMAv6l2GRxPC3Pci7foej
h+zpmPFfTRootYqPRw==
b6km3ileWTQu5Uq96l9dsXA=
oOj8v/soekbtZgctooxz9Q==
/GuMLKWrfizURewoooxz9Q==
BxXidMEVRPYm8A==
8WsQyBvwQiicooXlL+Y=
DTxu+WbWuIul/ZM=
sN7XcqfrV0gDLPk0Zf8=
5ExR9FWH5MQwMwCjyYZQj4xHJc20
A0TUgtg+bCBLOxrZEL6FEifw
IVqROIvRwpzHypaYQO5yf+807s6MpkE=
HlueVLPm1E1nJps=
qd6WN2dYplyQIP6j6pyU3qTUhQ==
tOzwnxForTEwuFF5JthlqG4=
GpvSid0ShiXU7Iw=
4COgfp0ORPYm8A==
qtjWnv0SinqyTWqiTQ==
+S0tzjN92LhjoYGGKfE=
F4qnNIaQp4ArtIQPtsx6Rj73
Pbha6DEUWTO612wCm19dsXA=
K2ByDFNIRCbXJLvTD/W5CjHs
KHYUySEpvrHfkicxooxz9Q==
Anewd9f/bTNQH+IkDxyt
UIwTxDEoiCXU7Iw=
I1jYpIxPqRyPojK37V9dsXA=
035qp141.com
Signatures
-
Formbook family
Files
-
4304-140-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ