Behavioral task
behavioral1
Sample
892-73-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
892-73-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
892-73-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
27a29cff69f8e0fe426f000cacd264b2
-
SHA1
03e2aab0e0d5f49827d253a7f0c31b1fd5d222ca
-
SHA256
f1c63ea8d8d582c373b5fe2484d54b32f5aaef00dd8e17dfdd631b47ea90d1b2
-
SHA512
d32aea46192aa1217d9e6b866d9f85ce99973b6b99fa256f439f2b60a2f3aa2565fbb1e81124472f2de6708cd129d821d25dd70e62133c907334bd4e64a62ac7
-
SSDEEP
3072:5bILhrP/WHTU5EIhTJWxSI5w/zDxs7oRcR5RsbZh2qQ8cduHx7UIzsv1:YrPOOnhTcWnxZA7sbZh2qQ1S+I
Malware Config
Extracted
formbook
ncpr
bVBX5DcJzr9yf94C3w==
pAza9ePFpFp759M=
GeHCdpsX/21yf94C3w==
A86m2jOAb2lCta5KjFGSBLa0Bdru/eQt
bEERX4lbMxXbYU3pYqPIU32+
XLFilcOTXqV04j9CxpgWTXS2
UQTWj58OqzP2ew==
MqVmrtvUwL+EuyI6FfY+xgYaxA==
Fe3ugYgE7GZT3UohKWCrog==
YsWZa7gt9HJXwDhOrwIWTXS2
9mk4g8/Nnlp759M=
g01M0Tsk/vVnrhpC5zZrpw==
ec6PYogewB7aZw==
JveT+/6JbtwGUcTPwA==
EO3y7N6/n5uK0eyQ+bdcU7x9zA==
SRMfKoboyEnEDYOUZWns8TU=
kW15b1o+IOtNpgst5zZrpw==
gUo40RWBHijfIAiuuMdrKA+WMdA=
HvDy2QVdG2cjuiJC7WrE6i4=
uwOMiN8j6q9/966Mltg=
jGl4hoFfLsM2gFepP7yasA==
F9PNZXw2urMl
k2FrywMA6aJo7cQ=
Ng3noMWKcFQ=
EuCdSYcTs1q158o=
PSkxISg1Fva3Bq6Mltg=
owviBgoV5l2741JmLBWt2yw=
poGxVFnHiIswLZqrHO8x
s4GxhtRZS89Ei3D67zF/f1TTdHPftqbF3g==
cURKrRXcL5oGUcTPwA==
/9buSWtJK3Mpdtj01Po8lZHVLL1eOPY0
H45aHTqMYOpwphsrEBWt2yw=
sH6A2FwjBeQ5Z3rUWtthoQ==
+cWc4/rSlSGWuN9+
V71ZMXn/4EYToBMbnAQWTXS2
XjULZr+1mZPtIRd5Hm45
GNvf2ca7mieVzbRhvhWt2yw=
tlOai8pPJq2g9q3Gwg==
roNR+zzHawfLZQ==
DvjMi90/KPOwLg+zPNAMvt0wkNg=
w5NlsQYyva8k
Zs2Ou/8H5bt8BQGCXaQHu90wkNg=
+F0fc8zJvy4howMRzwtLOdir2dnrOa4=
bzoKyxiadPnsg+4bFBWt2yw=
gJ9dNXnjawfLZQ==
sQGNBXFmQjH+iX4OEGnfoJwZ8EKj
W71kR3LUvFp759M=
1KuNrKJmAEO66tNavhWt2yw=
kOJy3d5mQEWzC3+H4C5jHgqc4dnrOa4=
JwWrVtWddVA=
mf23iNlF+LGAbWj2Ut4=
NZdjjpqRbWlLmwke5zZrpw==
m3WDjZyYajwEc2MPjAcWTXS2
LhghnJUq2bEy
G3Mm4RbijgT3eA==
shOpqBODYNmj9q3Gwg==
ontbDjy2awfLZQ==
r3+D+/p5Tq2b9q3Gwg==
ZzVDzkBG5dLEzcNm
bVVTRjUfCtuRHw15Hm45
1j8BKBn537Gu59Y=
H4VSiOs792XTF4e2B3NRy72I4GOD/w==
7Tb4rBHr2U8qlxgunO2+SwwZ8EKj
abdxkcyGTsUlN5qFztm9qA==
youlian.fund
Signatures
-
Formbook family
Files
-
892-73-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ