Behavioral task
behavioral1
Sample
472-59-0x0000000001030000-0x000000000105F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
472-59-0x0000000001030000-0x000000000105F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
472-59-0x0000000001030000-0x000000000105F000-memory.dmp
-
Size
188KB
-
MD5
b185b94453ea1aab33cd297cc4b00fce
-
SHA1
466d8fc8745842e5b424fd9d588d8c3565f33501
-
SHA256
0e72ebb3ec45b7bf1e0638c0e6f88bf8769095a73070ca12e84d499456fbd6d4
-
SHA512
c8a31b80a1e29541b6003637b53c52f1617bb813ff6e03c23a3ab80b4547371fc792535b37a84586d58316e040b442bdf9ee6b651c80e72a196f809ecbb71f24
-
SSDEEP
3072:AksKHeq9X93CFtWlzS46EZt0fTWb65kjj203eF9u++m8Y+SkdAISle:2R6ZCFc+EvgSbikjj203ku++mpCdA7
Malware Config
Extracted
formbook
q4k5
jQYgo8tIgmIc0mvpRb5x
WvKdh53xC7N4gDV7C595
3NZvdu4YVUEvB7v2l0Tm0SVv
/VRXhfIvRiNV3GOoZZPqieXuTd/oHzo=
iVrRnM8RfE8pow==
p7pocu0vag2HQeAi1Q==
jE3wz8cIIck7DaIRQns7/WM=
idYEkVhfx4USLm44
xQpoZwWMqZQZ0b+uff0=
1u0SiknP4Ls7GLQCxkszuinYzQ==
AVuV9lyovZ0am5kw6fg=
KicecBSZtmieUd7hkUDm0SVv
pMHRHY3n/dVlLQxECMx3
dE8S684NNa9pRNo=
2WKRICBuhDoNkuozMWGBGWPpliRqjw==
UnIpN/4ONxpFwu04CF57Ew==
lzTU5CR1jj6os+3Myg==
WR8IgU/HRPwvtA==
eACJW4jpYgiATdg=
BRYZUYK51HygS5kw6fg=
LCy5lutRkm/boz63mHIT7Bdp
OqnALPb+Yxrj
H7Ao9RaCr44SLm44
TdNqd8EUIQrVcJbmqns7/WM=
Ovh7T2DAyzk9G2c6
qHIM8wdzl2to+B9TLJbmqg/UzQ==
H7pNFDCV1ui2htKxcwbJnejwTd/oHzo=
vNT0V7UQMPRcGsM27gaYnNIT0g==
sulKq9weiSt0Hw5LcgU76gziliRqjw==
1i43j3PZBtqpen2SMLdz
xgX+Ty6gxXwgxm7pRb5x
dZW4RxqC4FRKvg==
nW0wETKj1MCEU/pDCF57Ew==
nVPCqNIVLga9Qkoq6opYA1Jc+wxo
NzRD0pr2N+UgpP49
b36rGb4ZWFA3y9zpRb5x
MfSCS2TYC/JySlsy
zQoyun3TCevkZrANJGb0qcYLERg=
2425INnkRPwvtA==
ol/Wnt1Jd3ItttLpRb5x
icUqei5ulVPrZ6L8t4xXF2tfq9bzUTqO
CkFeyHPpBuUbtPc/CF57Ew==
pzjDkYLH/O5ySlsy
KQa3w5OIQq9pRNo=
grzaa1nD9enouEzpqsRm
ZwSafJT5CO7mpC1gCMHReNKBi+VCthwmvg==
kMhzfwEvQfGqmTgv
ucrZKckZL9WDHjoOxCNQ+3Q=
LP6rl+oWWU8/EVIbqT5lFnJhrtfzUTqO
mvISpafy+9fLbHdC5Grm0SVv
UvqttwVjoo8H2xbmNLV5BA==
sz/iv8A4bS/jgJBiZmVlLIjzW2p3+R+E
jIiL+ZT5PCRYCK8saSbCuSSOAQ1g
FtWAh9IfPCayN3bZpXs7/WM=
1iNCt2Owt4vAfsLM738660xc+wxo
ZrC6CvFpxFdKtg==
rUHmxsf+Yxrj
Vy7Kg3zD6MuPMWjH93Lwp8YLERg=
vnsaLokBOjDaXpjzrHs7/WM=
+ZTHTkqDnQvEOllP739xDQ==
S2aA6IL1Ixx9PvN0xdqFRY+lpt/oHzo=
nKJEMVCmv3knrcJBGa1pKWs=
Dd7SLM9GsFSeMTwX1Q==
u3f82UW79J1PGrwW2A==
4222e.com
Signatures
-
Formbook family
Files
-
472-59-0x0000000001030000-0x000000000105F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ