Behavioral task
behavioral1
Sample
2004-60-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2004-60-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2004-60-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
1ad5fd7b00af69c0159196dd381ea7ce
-
SHA1
b53e05492b4e284649b2bde9b74ec94a7bbd43f8
-
SHA256
4d101363e98c6ae9dac115a98b8bfcb24dc3659d795c2e36afdb1acfdb8eef9a
-
SHA512
feaaef36a8586aea2190ac7125d2dae4db81caf64ce4cacfbff7ac36c8e3fd3d731ad2e2f54bcd88d6eecf1d309c1176e8a24fa6d29dd761c3f748212ac0935a
-
SSDEEP
3072:HcMbTY9yX/OlxHAWw1RrTMg1ZKzoTs+ihxPPLyEbjpiVdfYoPA8A8:Hc6AyvUHm1eUZKKs+uPPLyEbti/AoPA8
Malware Config
Extracted
formbook
tz8t
ny77rjODcxSfmMf2
Ro4c30aR3N8pqxgoKOH0nKpZ1DM=
Xz784MkvjnVyiOwsbwxpwblQv47KIw==
8E5DQ8nbaEVgDiQqlbCmBos=
n+Jwl1GgHG8xHU1BsHDG
KImMWN0zhg/fESvJ2Nc=
4NkRrZjFCmbstx7pIg==
kephKeYrhstVQqQYSObEksSLgDY=
pepRAInR/Ngl0ybL/xL+xaOJc2GUt9g=
0LcrLqfr4sQR9hDlIg==
WfSuYQ9im6fudNHAuU4qnBQwqlKg
SxQnURRzi2WtMVt/vNk=
iz4tST2moq0zPngkKg==
eLUdrzCjBM/pmw6rqF8sBRjLcc9OFtA=
+4qzyKMNHP4/6UoaVVp6VWhKbi8=
JOxXem3SKvkKf7xTTOdC9p8FMA==
anepSdQmIC6nN2795qU6Bm/qXvZ9x3a9
5k32ENdAijGAfu5OggFjy5Q=
2us845cGIIQ7LZEBArySuEk53z4=
Y48EB4G+/0vY3h9NmaVhJP9bv47KIw==
Pm2KNtUOA18U3Q50YO5TSiNMOQ==
Lez1KwZxh4cdFXv4W3EI82bjQ+bfKQ==
TSYNpS6kGOhAPngkKg==
BYo81kmcmADHtRZBsHDG
OJ6LrG/DByLxZZouKw==
IbfeBfx8vLO891tx5Z7f
viulTQNssMX3TLX2LusBJamB
WT7B+M0ycP7H6UlBsHDG
fsPnYF46cceO
m047XVC7GYIN7SNKVc1aug==
YGYf6Vyb2ry78lJd4PGPf+iJ
r/Rnj1q3QW7tng==
KNTLOflDmwqJP4IUVc1aug==
dUgttyBxwx+gbbAgYcAoow==
qf5g+YTx84OO1WzSCSbFrwtvv47KIw==
6aqYoIv2JgEIhOzx7nXEjYM=
IDqNUgE3S69we77g1ZGI2i0wqlKg
QxuAoF2m30cEWrjj
sXZT9Xi/D0Fz5UdkZfbOjsSLgDY=
/1GyS6G+SNGT
sS71s2Wln3K/fsRISNQ79p8FMA==
HGfil0GPo4fPVnnQ1ZOmDIs=
M5qiYedEOEHU3s06Mw==
CkyvP63wRjA3rNMejsA=
1z+EdGjjKqCiEEnt8mx0egDPJw==
Aa2WKrIgiO51asnxO2LR
nUIJx5/+XLYwPngkKg==
nmxpXt0amQq7lA==
IWrMWbQQXMEzPngkKg==
AG4f1YfP3NxnJFbJtkW3D8yC6D0vxfe1
NKtyPO8zQ0/fmwCuqURxJQ4v3T4=
PBaVv6vMA1ksjfA=
90wrsyVqWbt8iedKz0ZOegDPJw==
xxAI2n65F+7xK4+8wW2oesxRv47KIw==
TdKJGZP7AZib1D4VReIttA==
aZE6ST42gAAehK4flhn7UOfFG8KmB9M=
MhOaW80icUlc3VFkHecutA==
FOgCvXnjLcTQib70
dHLFfSpxfNGrAS3yYcAoow==
Qi6x5K/6/UUPUb8OR/YBJamB
7iOatrejE+7sf+8=
DcbD7McIlLUzPngkKg==
6sKlQsf/GXVTsxIRfHXEjYM=
4CSOH43UwRff8ygjm1iujQTQJA==
69t150.com
Signatures
-
Formbook family
Files
-
2004-60-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ