Behavioral task
behavioral1
Sample
756-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
756-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
756-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
3d391aabbb5bfe227d83aadc26f026d0
-
SHA1
438cf5c7016445cb9dcea2930d76b8adbf26c206
-
SHA256
246a88bfd50fac13c48e59ff55731ca347231f1e6acc99b6a56953bd18c096d0
-
SHA512
0538c1d40150831b5dca4388fc2357a5ebd940b3237e98f655f466c9b7b0405b515bb31b218e26c6ba8c74b0dce63d2849d5af2243e9ab75189fe90e643c4abe
-
SSDEEP
3072:G6OWLXpvVTCp9dNW4r3CvPptXt5T8/L82EsSRR3+hmVhCgZb:4Wl5O9dtrI/Xno/L82HeR3+8Vgg9
Malware Config
Extracted
formbook
dmpz
g6nVYcuLqoVCBunEXBXJ6w3fWQ==
ZcvMXCXftOLl
7llPyUdY6SDW+0jFjBhH6w3fWQ==
oNlI65OL5t6RGejebRdKsAjXGtsK8A==
kU64X5biR3AzyCEnlw==
dHWevaYxywS6e4PXkxhTtP/UGtsK8A==
tucfwSpD6EgygeItq7/COFAbH9E=
tSbx9dJa7CjaS9i1c3d4ImUJ
IlWSNsSPqt6mcQ3d
e0GDBU2jsOzL5OKBIzg=
N83IzuJUqu7g3+KBIzg=
nbC4xt55DmBKL0xV4GLW6w3fWQ==
Tk99naENrAzQj1piGbcl
6043tio61grD5OKBIzg=
HvXh6PMok+vZE1qjJUJClgSk+PAr1skh
JDtEXxkexjYzc+Bwc3Yt
sl+jPuCtSKWIyeKBIzg=
+eXvDCFojnwd9P79cBrQ6w3fWQ==
UfksRCdag5cHMXc=
7OW2uH1YngQA92VbLtpaRLmO/5JOL6k=
Z0k0ODnCBlNh9L25eoBQQKiC2XqFWLQ=
enR3jkAaX7q82uKBIzg=
5KzjT+4Gm+/kXehwc3Yt
zNgNMR9UgGUjaBYLrFLc6w3fWQ==
Hus5X18zWyDy
s6SgsLVB2z9FTJMQvQ25Jnc=
3Gdi5GJ5EWhTtXx1PJhBHA==
rUt8djH/GAPH5eKBIzg=
KUmPxmZh+iPpK3S/R7PtQlAbH9E=
BaKx4Jlqh5cHMXc=
842Jh4jV+CUZ5a2UN894ImUJ
hUnAYPQQX00NWeK/ew+DfMmpCLEfuns0YQ==
PMH2mQIeZ5yesguWhHtDCw==
oqXgJNHYIw7N7hMaFZAEHHE=
aTNm3BdkeVrtQLmFiFMH3xOb5M/P5A==
vjMxtTf3FvWrT07AnCrM6w3fWQ==
a50LuPV2EzzqjmdtKtJ4ImUJ
wekmPyanOGwTwq1wc3Yt
10E2wU8GIhfWRFUqnQ==
ELbHPsqU5Y9kJ2A=
eAcpK+DuxaRPYXZA+SE=
xB0+8GZxym5JgNMyyg25Jnc=
8asRpkxs/WFLWBTc
+zBdZ4ZNteDL+NTC
Xk43JQuI8iUT9uKBIzg=
76Tb9+yL2dCSQEmtW3Jw0z4sNREO
nu9ihjtBknwuR2e1XH94ImUJ
u2ivm9+s+TQ=
96LbB/6TM4mKm8IhPJhBHA==
IUmJnoIQphuaZg==
oESPQbH8DPuQbDPctOfYOVw7stAM+6s=
y+cpSkSGm8iLnuKBIzg=
hqflbsVWpYw/2q1wc3Yt
ixwhmhoryDgqhhelhHtDCw==
D1TH7w6l/q6XUFF/ks3VTac/vIrSuEIp
7nNsADB1kG0wyCEnlw==
RameMNKo82ZZn00CzXKmFA==
wwRCzzZB7FpWvUw7IEkM+kssNREO
F1HOEfmEE21dHg0aFZAEHHE=
S2BlY1v0Py75n2AwmB5F6w3fWQ==
xFndOHgzWyDy
OsP8mvsKn8uNonf1pnQr
ZX2WVrvGYMymcQ3d
H0qJKatulHQ0yCEnlw==
anastasiavekselis.com
Signatures
-
Formbook family
Files
-
756-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ