Behavioral task
behavioral1
Sample
1704-65-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1704-65-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1704-65-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
7b4f507bd04b65f29b3280e5e87d6560
-
SHA1
5e974b7ce6a8b33d380c7cf07b6fbfd172a8c042
-
SHA256
48f8f57233ab2439283e3d8394474a47ab5940f91b8527c4281141cfed4f2d2b
-
SHA512
1fda64753526ba6aa8545307feef86b0a30c723b9e298b2e43224129cf7ac8bdfcf0337effe804cb22254a9f86db8d14c4940a03461c34fa8dc6433c509bb8d9
-
SSDEEP
3072:J6GemsmpQpwSttWa4SPhANIYYUedCJ/YKURIdamEt4FTHQTDGA:5WmiHt7holbeIJ/TgIdamFmDG
Malware Config
Extracted
formbook
tsuz
7xznvXjpgziXgKV2gqDW
v7D1tLx/XXVj4TTJXNA=
Kksd/nV8o/fgptkq+1ql6A==
vJOH8u8W1nXX
iJ+tj7iKjquTOKxx/3r8KiNc63xxRA==
5xTbq0yL85f2O8soEE0aWGxrjA==
b4/knWkfwQCByw==
AnrOservDq83Fw92/GiG7pk9VAzP
o7ULEGiFpFC6VQ15RtI=
pcuYY7Ei2ReJqmM=
kNvNtWa/SQJpV3t4NFw83Ea4URzU
eGmxllMUuHzf
xwWU/I4R3RuT0A==
h4kM4poKqlXK9NCgTs8=
HkWLW5J3hL6vF2MFgsnAa5N5kpHF
u+nKjgM7r0ewzdd2gqDW
XE4s8ioNHndqM2P+krcGi9g=
OoVuNLkVoUGpwd56GXTPATwOJycptRJwdg==
n5cbiNrqOcpcqGw=
1dve5llFRkJ333E=
VIhkIJnSMrIRPEjarkhuARP5UFQ=
4gtsKskJdQ8Pw9d2gqDW
doN3bPYtiMcFVul4SGQizkTzEspICoyg
GDl+WkSi1P0=
jdTCig06g/dacntkNFGOtDjJ63R8Tg==
9uPJv0p1vjWeuLOOYveYpoiL05kttRJwdg==
uOU8RLSu41tMBOb7sD/e
yxdiTgQW1nXX
Tmm3iHYEt5kVZ+nGpet8ms8=
5wL/74DKLcLwMD8eng==
R0ebpvLd7TXMxfHijw==
9SGJfWrffUzasGU=
m97SjQUW1nXX
WFU3KJ6s+o4BD0VXK4NqkHx4
+WG+WtSmgoYH3ea5U8o4QyVd63xxRA==
p/f72WCqM+9QaS8Okg==
DFFnMGFJbs3CKctCTTrhZ8U=
fZjpyKMHrHmu8u3H
zQHso+fX0fDhjf53vfgDito=
m6WYVYpfTHxt3YMFvk14Hkc5WR2R0WA=
da+JXwtPuGTUMeUICI6XSNE=
Cit6QDvSGTs13nDFmQ==
kJMS65TRMrCdQoBt8EIaWGxrjA==
BCES9iwTPpqBl2O4VdI=
0gtRG3KTzEGnydd2gqDW
0e3Wl+glliIQu9uEhBOxtYt/
ycg17Jb3Z9G5graeeKnGx6fbJy0ttRJwdg==
lLMNxIMQyLsyPQbpgQ==
KnfuzsZE8tVKqC8AgORljYud7XKyx/Dxfg==
//nvxfKwWrqoNu0QyBsMids=
DmXXv7ZO3RuT0A==
UVNSK1EJ6Oi/9fTljw==
y9vZuOG971+C4vDN
da4Oy8Wcre/8oCl2h4jw/w==
7zMxHZWTrvHXptmEhBOxtYt/
IbGmEq4k3RuT0A==
Cf0Nz9KViMGtGbsYkrcGi9g=
Y1/YhvIwwpQD4dN2gqDW
IDQS5EVToyDMxfHijw==
fYVqHtHJ71q4ztZ2gqDW
LV803T8ry01KBye1TaSH/hP5UFQ=
g87PrjNu0Eqr2w331CseyUXCJiVa8I2o
cs+jaMvaHkJ/6ns=
a7HwvpAyBvIquGw=
neapmali.rest
Signatures
-
Formbook family
Files
-
1704-65-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ