Behavioral task
behavioral1
Sample
1084-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1084-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1084-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
a08cc6871c79aac77d2f0792d3fc392d
-
SHA1
cba3270954b0320bc48b3507f47d80fe77bcc620
-
SHA256
030d047dcdb0e48840d63f000694615674333a2947af0c3e3a6c156d210f2d56
-
SHA512
e3beee1364df4315dd2e640a9a91e9d21d0ab52d1fc4e8ed5f6ba6e3d32b8fbe87a5da441dfa7c998b2749360365f53b90dd7fa52b2ad777f61f10eed8e213a3
-
SSDEEP
3072:06Wr8cb5hGXwp/ZYbqJWBLx4kjHwM4vQTrAPAhG4fPgnL1OXCasq/hZGJQ5iab:038QwXkWq8LTQMyQ3SAA4fPgW/DGJf
Malware Config
Extracted
formbook
ubco
D9xOxm+4Ib1gTNVfXjNjWdw=
khxeT+ozOgQpmB4D4cAf
fQ9kzG64Nwy0lj/g/Mdkk6hY
tneKTyz6OQQs
rT51M9g7PuJXjLPT4Q==
SwpcIOzG8Lai5qE=
xszRWnJWWvop
WvBM54np36jSQXED4cAf
hz6SfiBxVSnQrFR6DIJqq/v8434huw==
mwpor0eS+mDB+ir1nyEX
V+QkHMMRF+UShxcD4cAf
KupRVAFLPgaEWP3I88EhlNswMEHK7KXZSg==
N7r5cB1imaVNOPFRkyuJZ98=
VBaFhj+Za/RmS/vQ/shkk6hY
Vxp0WhI3RtBBG7mKuHbowv2yQP4=
/7YU/6QFDOQZkx8D4cAf
DXa7dkdUHAktkg==
vjpjT/hxskru19sDMe8mL8U=
0Z4APtxHWCEeiw==
DcYzoUiP158BTwpDtIYC
ckSPVAt6b1BEtrxJkGxQjw==
njilG8Emo2gT7sYaGaY=
FOpKkzpmPAq+xtbm6A==
U/ZLwYDbK9CvWHJG8A==
jESXG7ACxWKKD+alS7E=
OwxTF8cU6MBxXiJ+rogC
6XfvJd01FNaEbCJP27H7bQsiOZEyCvXxSQ==
r7SeYWdEcDowkA==
BpoBczGVvVB/pCFC
L/JGhUKiu0k6mxsD4cAf
EpoNRPMcumBJlg==
wXzj2IHKy3BmzUha0YoI1RmF1uaG
dEiKLepLELbWRrodoywa
rESwcQdhiyrLu9P+ILYsB4TDYGaNZ/IBVA==
F77/rViRzGTE4BJCTO8mL8U=
iRJXwmGnJ844A6dJVTNjWdw=
EcjAwVGa/9cN/K4=
V9IOgDmNC7NUjQo+/g==
K+skTPxLbQ75Xpc/kGxQjw==
gCBIALEL2GvOrTbrtSEWmSlQ
31afCLH6Sy7Lv3fY6ZEYEy9kt75qmNs=
2kCpslW8A6CV4wmfi01Ehw==
wXu3bRJyQdMAk0Nw4XXNebtJpuOnxWxz
McQQCbMeL/ApsI4bM7k=
YYdaaJJy2u8Z8KA=
rXKrYgVmYvYb0Zk14w==
TuBTF8sw64OuH1coyok9sDZX
PgFk3YbnXumQhCAD4cAf
3bcqHsjyQxA0
sVqsI841wVTuw2dAU8ot9B2F1uaG
31aTmTqIr4K5TPfD34Tmwv2yQP4=
K+lTUQNMHbXZSs7ETObMUGI8YA==
QQxRG8g1Rxh/pCFC
tYP7fhtwAdN0R95sMgx+aN4=
Xswq3ZDkeU7xxW05YzNjWdw=
HgVItF3ZZWQ6uS/P34gLQIUcxsyE
CtQY0mKufxMw3MqVCNi68TxQ
OwplwWbBL8ZzYQsstcfMG8s=
ikyMu12i4bbvbnMFlzgwe9fMn2IFeI+wQQ==
iRhbTvBRjmiV6a1qjCmzvv2yQP4=
lEegizKDVB6acWyDSFBFhQ==
cbzY5nyGLNIj
z1+1L+ZFwmAF+sYaGaY=
ZO8VFzkycDowkA==
ramlendingservices.com
Signatures
-
Formbook family
Files
-
1084-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ