Behavioral task
behavioral1
Sample
1060-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1060-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1060-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
2585d7a921157ecaf7e47bea707fcdef
-
SHA1
46fbbff58a8b35e422ef0cd7e422e3f5fd6d3ceb
-
SHA256
f8f468d045763786564cee31a7b70f0dac9d32bd02838744f026a0aec5ec90e2
-
SHA512
bb9ede5de28b804570ede4741e1f08bb42616365eb7537369dba46627ddff36d616035b7be6e50494d1cafda70380c40ca3532b7c4e44b1e67a50111abcb2ec6
-
SSDEEP
3072:RgfLbbDj68jhTJWyH47kAH8L8i3ntJSmBlzSHk2o/2jjKd:i3bbhTvFi8IotJSmBlGK2jjK
Malware Config
Extracted
formbook
03v6
EQ77dY6rTtlyHzeDfLGU8A==
5JAmKTXoHZUsp3dtX4+bdJUDIp1H
hVhb7gyw4T9azAkZow==
RQhoaHku1QWxh6j4qxfYGLfKtgEz/vk=
USiNh5ylWg75nT33
EbzPU3P5kKtKzAkZow==
oTodo8zlGj0Zm8kfxk9q5A==
nzMSneMGlB27lfRn99rxR+i2Vmlel5ni
AncA4F/pAo8t7WM=
HSeQm9Vtji/Pp4JfGxJBlCazh9lf
kZqGL1P1LtSETZqkZWKY
wcI6ZpKz3el/T3jQee3U675G5Q==
F9w7dcjYOtL5nT33
paa+QlxsiXxYGWs=
UzWm5SbBInEyOXM=
nDKApASMzW0yF3sM96T0a0UIHjc=
Y1tEyPURX28hzAkZow==
q3y14RSfKDvx3x5vNJoEDOrVZ6RTqIM2OA==
Ghm+tfwIO1TkoAF2a1uQ
8fxhg6gvtdiiiKK3fLGU8A==
HexNTWZ9LctkNuR2a1uQ
AbwmUowiR/a2sbi4sg+49Q==
oamfV6jIcQPUwuMs82QhmXsIHiY=
UAt3dZ/mSPmX
PTmQorDK7Pqsi6uwtxk=
hYjW5/kp0YMvIOR2a1uQ
ZW8z/7RqW+GK
iky37zLN+nYyDXMFfHPxSO6zh9lf
SVjV/lHsBYE7FXD3517sT/azh9lf
ICADgqS71/CTZ9BnLBppkl5Y
CNyjPn6gzcmGJEhLug==
q3fc4DvkhihlHxwgoQ==
p7KaHT5HbXEKz+Qv42ai6Io=
LOgxFTRNBqlqYfV2a1uQ
k2C6z++Ty2s6PzmDfLGU8A==
FyIkxw89bYMK1/jNxR8=
v1EJuw6hUmYczAkZow==
LsAMIENxWs5qcA==
kWiAQI6s+hHDiDnv
azYLW7XF7+6djdZhUcNqwqcuPz8=
/fh5kr1BYv/5nT33
47ifUoSazeh5V8F2I/hpkl5Y
47qRV4mFF292W86XTCtmsHtdgcy/OOg=
iE5T+DRDiWBRK2g=
xsSaN61WTu+T
Rkit2AynW2b+vHpH+O1pkl5Y
0KwlT6I6gsl8Zw==
URs3txnAInEyOXM=
oJKCPnWFL3xYGWs=
dz8as/hdZzz02EnOMQZp1qVwmR6Pn5vh
IigvvsRqmSfXrhmcGPVpkl5Y
9aCaOnTtm7aOdeAaswg=
Bw4Dvf0f1GEy6ocMn36Y
r7imM2+R3Pmig6kfoGyiDPuKH2ArWQ==
ipRuBB8luj/12T+XQqcwmKcuPz8=
CtHIYX5qW+GK
9PTOWmsNOdFdJg0nGQdpkl5Y
nXpvzVR/OM+Db/d2a1uQ
Iv4AY3aY/8JWJ58hC/hOx2c2wA9el5ni
r3S82hOazW0W9qinfLGU8A==
/QXydKS03uegf2p/dYG+I/Kzh9lf
B85EdqQhUrSVbyz+
22E596pegsl8Zw==
iVhrIFA2MNmL
planetthermo.net
Signatures
-
Formbook family
Files
-
1060-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ