Behavioral task
behavioral1
Sample
1776-65-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1776-65-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1776-65-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
b90d08ea5ce011113a97898c90959ad8
-
SHA1
a91e53889902cf295e4caef6d6293f0755863834
-
SHA256
aa917395bea5307908e996d5987f30a4e6397f20c9d368dbb6be6f47704261e7
-
SHA512
1edd100a560a9e9a304b200402b671e8ee14ece53912f8e77f95e83511babe503fa59c968b86e943730cce3300fa2eb5414a9d92cceda00ff90b71480f494df2
-
SSDEEP
3072:1ciD1a9IiARsW2SFtWmliDPh+HUXhw9+m3oHcBmt/vgizca92nnlb:iiaIiAeXSFX0hkQGj3os6/vgin92n
Malware Config
Extracted
formbook
dj6o
eHTcR+KSbIHKrEJYcaqomJrw
d4CQy4B84xPiXuPwHUtF
8eIkbHEq+BPxberwHUtF
m0+kGJZPG1H1jgngcA==
AMbXEsJxX4/J80MD
cxBd6axquGelQQc=
J9URjF0q/TbJ80MD
HxxYujs6bp7dberwHUtF
VhwjWCuW1Xau
Hs4ZrXYwBycFVX7hJpekXd1oRg==
XyAqZOXgWECQBQ==
H+HaBrNXMlQ5j+GkDTwf7dEalRSG8g==
Kvj6PwPvL2f1jgngcA==
q3F0mzHxjbyi
G/sniBrf1waZ08/yTxyN8qLm
9uD0ZBYgb5ZiuP3wHUtF
Ndkqiyj14RhyZziD6WwV4O8=
PuY9wEs6hMAOTUs2mUCtdjzUeRyb+A==
PwsHXAKokKjJ80MD
xa4YnG9AI0WKthDfFO0=
MQ8MH62d8yYM76ur+PSq1rv4
3bzBJcCw7xdiv6jgTRiI8E6SoqA=
gllski02plO4hezwHUtF
fFupcJ7vWECQBQ==
t6rT74IzHwBjQg/PFfJ+XkwUqbyJ5R0=
56Sm6qNmn1DQ0GlhvXvBC8S/VqKP
WUlz+MBsMUUotVBYcaqomJrw
byiB84SNALIdtosIbQ==
Tl6H0INUQnheJvdAtTwA8vY=
AqzubjoPnUI=
pjxDfDsybJ4Evov1Zw==
MAQDK8y6Gb0I8vGtGwxpvjK2JAGH
UO5BqmVqz165KziylGwV4O8=
47b4ZydnxKzyMwE=
Bf7i1stH8J4Hvov1Zw==
tK7qfS7XseFCG6OY3GwV4O8=
p7cCavm6qOBKr71GbhlsLg==
0bXQHb94wGTx++0ubw==
t46Y0lNYob2TEONj2nnu4vA=
gkCQBL5zSXzPIzOm/2M+jjzEWfA+cYlv5g==
Kzh59Yh31ILszGVWratKal6xHAOH
BLr9ZQYBWbxKmbIgLtHALA==
VlyjEKNUSG6hcUoFandY
H/INXiD4y/bdLYKCq/LdOw==
f01NhTwlcqR+CogrfHrHtan3
V6baC439Psa1
t6uu52heoTqUcvDwHUtF
bXDKLuDkj/MmnzHyQ1Qp7b2/VqKP
kFa9Hr2GVXzP1qfEwpH66PI=
hFlcmTAgXE26HA==
85LuilH7N+c6mufwHUtF
9Mjd/JJR6hbo8fQjZg==
SkA7YPrxX12JbRo=
2fZDwaBN5E+tBw==
VlSNGsrK/95sfUVy24flta+6Ioi43B32
CLjlLea4n8MLvov1Zw==
S02ihrc5x/C6
gGV6xWcvWECQBQ==
EcQcUtKDg91tUQ4=
YQpcvUdGvKPaHg==
YQhIzXwraFg/LwQ=
pJbkcPbqSzli0jIB
x3zE9noxWECQBQ==
b1pvqkHtG0wdjQv4Vz+4h06SoqA=
hotelarta.cloud
Signatures
-
Formbook family
Files
-
1776-65-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ