Behavioral task
behavioral1
Sample
1752-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1752-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1752-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
4e9330c71fbc8daff9dda54465423651
-
SHA1
b72328672d525b428df794a339eac436c922ab85
-
SHA256
02781f6bedf35ef3f98902eb372a71df3dd2ec7a8492a3cf9939e38b0934f51e
-
SHA512
a65cde050697bc4dc13e80f19508976ee42358b5680bd518ba4fe117eee276e450df4b095d4e6a4fbadf7a00ff8e5438068772b43412d694aaf3d1af0339616c
-
SSDEEP
3072:OuYdS/yKa7d8QyHAW6s47EJldCk+cIxyqT/dosM/8vzOn8KuDg/EyUDz:6S/G7OHUs5zC1txyqT/dmORDYEfDz
Malware Config
Extracted
formbook
s5zx
wMAY83Xf8pYlwmcLm5HvBdaL
CEtcpyGISM/CVFQ5zam3
jQE/nMmnXlmcTVQ5zam3
kUtRVpN/YY33wLfac81TKg==
WxtrRs8s52o/GPsPog==
w8LUN0UWABcTD1Hv
pCU+Wnk+6/E08im2Xo5y7uea
4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==
AbPNtFXXpcoeyWB1WGC/AOiS
5Kbo75EKwcLiArHSoc/SIg==
IaICXWtqc2xvU++OXEd+tRitdw==
x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=
Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=
rltiOepgaw3Mk0Lbt1yoxuA=
z94mjMxyFcLUu1Q=
xH3F3Hz93BCSMuBtI65JGm+VN3xm
+GO142npuuptGPsPog==
WX/VsE7R0FTm3Ju2ema/AOiS
qam0OKkfCyE6ZKxZtQ==
0ojGr0OMV9khz+4GoA==
nh6h9Rrbak7WPQ==
gHPMoizJjpupoTRLvw==
LiF/mkXSvIxF5v0Oqg==
UHnS03X1w/u1f87embNLJ/qxdQ==
wsYGdd3IQz54
6Wxsb5rIQz54
ykKQ4/cC8vQ/EU6kopGq
bvr6Ax3nlZa+NUTdl3W/AOiS
akuLZxGGXP7DfMnYmbNLJ/qxdQ==
jHv7ltTDvc0M34yoIq7hdfywfQ==
r93neCCXOnAMB0fLY0ddystyAGI+fg==
Qmx/5GTFjcieK2N/DHQaEfScZbNO5EU=
bqf2WVk212cy1PH5cssfPgm5fw==
joqgONJPAimIO8jbTLPOGMNuAGI+fg==
yvNUMs9XWuBs4r4k1Rs=
khwlKGJH4UibRl20rJ2y
UU9TqmSYVdnCL0Tp
UlNWweXQzcjTuErXu1yoxuA=
aJ+rLtFJR8hcOD1Qvw==
Or3H3VU+ir0zGPsPog==
LSY56NGzWP383GHAlnSg
kozNqED8pEhv
FkxVrMKYnZNFvUA=
RTyUl5h3MkicailGGQshuMVoAGI+fg==
nCk/JiMTog+MDz5XEHQGC/k=
o664Cxsa2F5V2Ra1LhujVMO+gZQ=
1ovBmTe+1Xb+ZHuMKJoyCtNuAEU4aQ==
AkB84Az8s7LtpuN9MxElopiVN3xm
JFvkBAfy6afux1c=
FMkFsSqPdxCvnjlUB2YYKcO+gZQ=
zQ9VuuDsCS5pCzHDWlG/AOiS
HAdaXQdsDy15D5mtbV+/AOiS
sDSY+R0G8RFV9RavQgYSq8lyAGI+fg==
x8ETGLgSEcG0mkfemfebVMO+gZQ=
6Bpc3FmrifP5s0o=
jNVRvH/Wak7WPQ==
Uk+tyoPu7XXyap7Boc/SIg==
0I2MVU0o1vBtGPsPog==
cZ+8Wvp7lA0c2n0Dqg==
7h0kg6GaVc+UYM6mggA=
vPYixIXYak7WPQ==
VQcjBg3xq7g7KNXon3W/AOiS
ti0nKzIWDyAZ8RixNB8=
BmdzwkR+G8HKsgbXuBk=
plckwz.cyou
Signatures
-
Formbook family
Files
-
1752-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ