Behavioral task
behavioral1
Sample
1200-67-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1200-67-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1200-67-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
11ab9f25a2e66e6542ee967a43397419
-
SHA1
360f6faada7786d49de3ebb95777ba44b43f8ab6
-
SHA256
4d33f5220d7378716948ec64cfa0ec41df4003b6cd16f90136ca5ee247c3f06d
-
SHA512
019234be95d83108dee5c7f8c5441b6b781e1fe370cb2abe2b80ead59f62fb1255e2c4a967f3ead55657572d527d9d94b66402ef71d4bfaf813a408e5d459be3
-
SSDEEP
3072:cnwQyGuectA8BP72VeuYtWAkiOeOGFarynhWRSCljOGEe2Ufguj6QseJ2dMl:cZYDHBaVeuYJHZg4cRvwGEe2c9Xc0
Malware Config
Extracted
formbook
e5tj
IQLFANAMFp2dn7mZspdRXA==
EoWBJbIeTf/IEhN2tg==
t1KUxwpOYU4oLFGfZZJdhQq1lq9LHrph
xDEbF5vU5frhATMLa5pba9iC2yYuTWtw
2LKDxpGoO+S/s9EmspdRXA==
8NNah7QKVO2dod+Fpi+q
oGnsF2+XtMKXmbeoLtOhYeNuaHZiXGFp
f1Gsp9YcLTb7UmQz
oTVhZFq6BY5UrUqWDTG6FIIN
bE0WfqLa5tGssaMoQds=
Lc0fHjWZxXBweoZmBC0EvvOlCWPHeaE=
bn80YTOa+rO2+5z5u9hCCIlQDyhb
vYjb5P09XQsARiJsrw==
NLGCgwhKmrxcumK64JZh9DcJRHJiXGFp
bXK7op7g/I+Al7mZspdRXA==
4QKNwghqw3EwgyGCq9ekaZIvAw==
s8teYHPK3VwWDDJ4rNSreztQDyhb
EmMtavldibSHE04q
0kFO3tzFY48MVd4=
IUlZqHyy0Qbf7xsGehjXezpQDyhb
h3VMj2Csw/TExJu+PHC/
wdWXwaT0Da+2y9WcspdRXA==
3DURFJryNWtspVWqO9mjaZIvAw==
qAd422Sm7CLhcrGauA==
pJvz7QljwCwxX6MoQds=
PcWeqz2AlJhhtV/C3DhTEEw=
4Rkzdj1yhaVGehp6HjPbVYExJatT
w1pgY+EgL3QXUJJz/1agcnvdDl4=
qhPe3WOfttvd8f4VUXm9
HaBpW9oOEUrTyexIGTG6FIIN
c4ULnh0BTlBo
ZDmSh4TwKHhxsfQVUXm9
T0+t9PLEYo8MVd4=
gpHmzds6gSKHE04q
8ExNmFaKjwT8RiJsrw==
e/pAieYBTlBo
1kKDyhFZqtzmevVssg==
gT2olpMBLkT3U6MoQds=
EQ5cR56rXo8MVd4=
8Gg5LqkxTsiXod6Fpi+q
U/4FJvljhKSbrb2gONOy5NDQ8CqYHq1h
U0WKcn2mt7iwwpu+PHC/
1+nAFMscQHCC0g5PFzn8JqtR8ArnkWtv
hMa8vUyerK3AC58nEzGWVA==
G8BJcLIoVggAGkmKOOFhE1kPQHFiXGFp
Gx3aIe9LYGU1QX/S+pZictplBDV1DQ==
/5XHztQZf+TGvQ==
ofo8e87+XfHg6u7DzWg4Rq0VLW9iXGFp
QMMIeg1JVVobZJV0cqH1aZIvAw==
MCKlY/JXtFYqLV+hPN2RIZiaeQNiXGFp
xVCV1xmL0F4LZftaEcO6FIIN
En1tU9o+j6JEixuCVnnT08iiMW0HkaM=
KD7Fgz5JfD06wfueRNqbaZIvAw==
+4nSRssdNSoaXgxR1xN0SvnlfcP/lKs=
Kedwfo/vHLqps9EmspdRXA==
DJLL9ECm+CxKjBdysNGodjHo3Oa+o0dCAw==
jp9jo2naBxf8Ct8PR8w=
jdno637aJEPfNeMqJE0BKlkiNFKzGg==
92VERsk1UF1pgZyQM9OdaZIvAw==
DulEO0ej+sKtCgBVqQ==
w8tBxzABTlBo
/grPODeS5JisAqwBqNGwen1101Y=
dFJDeT2luMO48owVUXm9
RK+Pmx50vURRl9OcspdRXA==
loopano.com
Signatures
-
Formbook family
Files
-
1200-67-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ