Behavioral task
behavioral1
Sample
520-68-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
520-68-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
520-68-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
513796db5754a2309b1dc1f18f354939
-
SHA1
04542dfcd66b4af8bc0609a36561e5639e24d192
-
SHA256
aee4e65ca26dbf1b151fb70ba563e641d67ec877a98346448000d09e4634165c
-
SHA512
c810fcc05f57b93ee07a8946bf9370521c81ef30e2b897eb8e76192ca06579cf20513f19293e0e6c456e723497e395fea7635007d195e8fe82177197fd1397f0
-
SSDEEP
3072:hDKBDnZRGRgRsNbeJJte9AWr54KDwq+plxJ13bSNlj0iGMDAdJ3:hDKTg6RsFedY954c6lT9bSNljZ4
Malware Config
Extracted
formbook
a62f
yXIdu7NDi0HSVg==
rDFbl4AcpwhWtFeQ9W/XLw==
/kJp2jgTF1sf
VFd4Ka1/mAX4qU7X+w==
CbnnB+GKABQxIlTA4w==
dBJygW0C+u94uJLPym/YNA==
Vmtz3hs2AeR3fxOw5w==
OXASHPmEeXICQ4I0W3BouMqu3qfL
DSpA1TI+LZ2REP052OJN
FDKAIY2jgbWJDv052OJN
8PWSyrlYYV7O6iqAz+5Q
aJNGZj3c5iKep2jF5Q==
0XSpvrM5LRd/nM5NYLmWZa5JRFMWEA==
AxGhm/D//GxUuu8cs2JMJ50NsTE=
191jRaTArePeKY9Qnl7OLQ==
gyh7f2gGAeAsPFq9mEwtBkL0Yw==
0nUgxDVLuPZcq2VjsLqthEA=
CDNl/0xzVoGRo4rG
LF8YT9nr6GBBgnGXpvBL6Mg1aw==
3AV8qYAbm2kV
S3axIXiEBFG3bEnnIWjONA==
UvY6WTbRxPG/HiYCl3RTIJ0NsTE=
mhi4Lw2s+xjnMQIXq3U=
L1R2F4+llPC09U71Bu2cbv50
DvoDH+Nxstal+Mk=
VPKgHe2JE6kEu4/D8g==
sDLNVVcJIUcsON0=
1AJQ/oSaHAfmaHaG6R2LY/1z
1oQol3YIZpItH/X01uhN
NFyFAmtqupqk57Dnk0MuAFGtaPiQmys=
XVbs6UlNNItXnn1H2MMS7ozC67nS
7QpW8zlPQiZu64BPnl7OLQ==
cppUjA4iKjaVG6oyFdCtCks=
ILEsq4USi+MqW8f/lWo=
tGCx5dVx7EKYRWRd5XWU8ixm
7/SIjQwxGoYULt4=
XPgiGYuskGzHQs+lUcXtw1s=
f3YNAVqGaZlqtbuiLhRvSUisnBzCAdt+uw==
Ve6ZEe+Pzm26+1/gwGheKA==
93YEb1X0Aue10rjf
0NINu0h8XLC08TWBfGI=
/4In1CpK+ppqsvlnYZUAzg36L7Bzpr4k
6whCqwAY7CP3D8z4SBj3zV8=
0uKNlvbWGYOPFRjzeF5RIJ0NsTE=
GaQyuwwrCnVcqVOw330=
hAQqf+kUogZnr0YXr2g=
2fE6CW1ht5X1DpNf6g==
u7ZdPU/o9OW10rjf
reKIrjNIWM/kgZJl6uQJHVx7
ZJTupQ4elW5AWcf/lWo=
y1x9q6guJvtGVoP6H6QitKk/cg==
1ORykQk2kM4GQqVxE428jUI=
aJPfkA02CeW10rjf
vERcUy+1naUCQxQsz7ihBVU3dQ==
6xlP71yCgfZBh4rA8g==
I2nXHV/gudkCH1iQ9W/XLw==
7OmJqnUggGU8p5eAz+5Q
93wUi1nzZKsVXMf/lWo=
xuk71TNAGnhWisEwU91Q6Mg1aw==
OtxRn94BGfljp2jF5Q==
nEicyYQbm2kV
rDBEaF/nMInvSNhQcNpJtwE5vDs=
lJgb/V6OaaFxt5yAz+5Q
qmD4jI4mcklXm0k31/tY+NJBcw==
grandviewcourt.com
Signatures
-
Formbook family
Files
-
520-68-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ