Behavioral task
behavioral1
Sample
1436-64-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1436-64-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1436-64-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
d6b87aa9694071792eaaa9f48d533600
-
SHA1
66a77ddee143540a74912f39d99aaf83726f9dcf
-
SHA256
1296e7819273e00264a82dea1a4c0bc782f4b1f212fd7e78990a7220f715e3bc
-
SHA512
99797011698fe497753e71ae4c7b12ae95f2443dd425f910d11b46100c1f131f7408273aff83aaa87adbc458cf9dc105f7a5de6661be7f43c6ed5072df5105af
-
SSDEEP
3072:IqbG0xS3xYLFA1pWZ66oUO6Pj+EJdAjzlTg7ul3dwt3/m+S42M6a9SBZue:lFkhou186h0jBXGzl87C3Ct3uh/cuue
Malware Config
Extracted
formbook
mgah
Ga/EQGhABsbQ5owg2G/5oPZnI2A=
/3iTRooxSOJyM/D+2s12Yy9gTw==
3GSDD14Chww6H7zCmD9ynHmX
Taq4VrZPNAxl7eUe34Q=
3jAUg3OGzE9b/rLrwYKXqlyLPJTioHvYGg==
pyI17hAyA7tR+pso13D+ovZnI2A=
iQidpK8EE4ruTAEv
VoC+z/xSCeNxEcfl4A==
fNqiP5k6xGW8GMoEz2p9sQ==
UX434OsCal7/0Yg=
GZGI9uo1sTqPBaTYnn13rg==
oypWAhpp+ZigRPUVpC1JtYDeV+LP
UJJ25dHwenIU7JM=
FoUiKRg6Jq8387VRFNpzlQ1BRw==
M5P2HBpCkk2qMPQl
6XMKM2j9QQAjOODfDf5tJ8Tp4mg=
icSTi3uo8bndiBUiIfwglQ1BRw==
MF6VwSbQ5av73I4=
cOqgfcgJaQBKrUa9szY8
FYJpLJEcOxwyGcTenNR1bfZnI2A=
ngIMnKgGjxspxmnWcTc/
v+SiSqgxmAoyBejv9w==
wFHlqdJIvUhiGhUYC4o=
7UacDaC5lrbR/JY=
Mlb4eqKTnav73I4=
seiK/sLCEVOABejv9w==
OMDdaW7ATdrjtm2TayJynHmX
JGJNwcIasDKOVAPL0JU=
A1Q30Q269MVj7KbZnn13rg==
qTJD6wQlANB/Ecfl4A==
syUlpaPndwIsBejv9w==
jidIsdtm/Mzuii8//rGrGxAj5kpJrw==
GqtMZFxyrr8K5ow=
mB+eqQBfrlt2nbyDxuA7aG8=
wRoFfITXZwwhwmjWcTc/
N1ilv+wiEaI+AbgEx1obzWc=
ieI0Wkxpq4IY9aU/DuA7aG8=
9A7IV1y5Vub+5JfJ4aPw8szj5mg=
wC6rveZs2nF9Bg2DfgMi
Tnc81fNpYvSNEcfl4A==
RnUi4zuKWR2pBejv9w==
HZsbJh5Hkav73I4=
0UbB3RO8PcfellvWcTc/
/jf6e6YPlrbR/JY=
MYNo29AZoQ8rBejv9w==
BzfyY5E40mJpJekHkiVynHmX
C5wpUWhtmGaQRBXl6Q==
hNrXcqxEYiYwBejv9w==
JXN8E3QbTYKqMPQl
+joZsPSXu4klsXKXcQIkaPco+jospQ==
Oqok8lLwsMjV5A==
tvq2OX3KFe++bwEn
2gg/X8serMDg7g==
p+ylUbJSnFFnYgGbWQyNgXY=
2TeDgb1cf0Q1nq3WcTc/
ltrHPydMxFJZDJ25kDpf43+gX30=
g8STMYgttUZnOeL46YMgKvZnI2A=
T4cd3cMnJZM=
0yIKqc0MhAli9Kfb6g==
HXYAIojXwLsnPPEj
IWWOpgKptkLRUSzFzpU=
RJt0BkGnbwYp
f5xR4+H/ZwkoBKqmbSdynHmX
yOzpXdIesMjV5A==
maanshanbiyang.com
Signatures
-
Formbook family
Files
-
1436-64-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ