Behavioral task
behavioral1
Sample
1672-67-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1672-67-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1672-67-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
db87f238bb4e972ef8c0b94779798fa9
-
SHA1
594e9a32a57fdaecfb5860d5b33b1013e16df92e
-
SHA256
8c93021ed85bf3dd5342aa6bab476feb6f85f3f186a5dfd70af8304de5756222
-
SHA512
629a13f171b6a884bd2823c30e1ea648be8663385c25548996142fc05ee27be48256fbecef0f646c7bf45a5058f3877940b756f88eac963404d780fe60542d35
-
SSDEEP
3072:iGr5kLF6bh3flv0gHAWGfgr2zPwNbYkV3MlUzx6vP+bL0hJzhZJ2ocYyMMV:3d3tbHcflINky3MCl6vP+0hhrJjcN
Malware Config
Extracted
formbook
tfpo
mK6dpXCe+UcF3/ijGYEvtaw=
AjgFL5TgGHi3
WGpHkSiK39I9ROHt/K4arK4=
0CPoN/iN6+/RUaeZ9GNo
XZB0ooFlhWHxDpyeza4arK4=
isLS7tGiBvPMO9JVha9nW84WGw==
NpgNCvr2JzuCrk4=
drZ8kwpMU83J+8xSiA==
dNu0CkEnRh6WRSGlyKA=
HB0OIKALerCybLO84HtJnhLE
RlIWNIPHSI6E+8xSiA==
x8y0yi1z6VIoDjPlCbNh4h/+Dec=
GiUYJz9BSRpnmf4aWQO4c6Y=
O4iAoqaoJWnioucUNK5e4x/+Dec=
ugz1FFD1SqQ1VWx/
fG5ESl5k5yegyxrES0E0dA==
VkcfLpHzE+zHTJKW8KNW4h/+Dec=
0grZEMw9XzwXkDTaS0E0dA==
JC/uCpUanxTb1B7JS0E0dA==
9jREY3ZMgbXXTutolsKGv+4vSB3B/mMcMA==
4QnaEJz7WJO2o0Q=
PSwD89u723C8J01ssmNM6R/+Dec=
UnpJa/xSAhR/YPtu
JJjkRhUsLXq0
+QXKEWdd71Xwr8zQ94lJnhLE
PjT2PYp2+4ul6Fk=
7QT+aiiXIW8TA6CizK4arK4=
DQUOMyIsLXq0
osemyBllmCbNulM=
xSUrTMk5Ut3uKQ==
pwa4+sxQgkw6y1iZ9GNo
KYnwFxveIsz8Ng==
pg8UZiyG90oNEbjcFgj4goTCGtLI7/0=
/DAQMr1BuhTY+8xSiA==
T3VGcCWi6ymV4DZm
tg3+VPhWoX7tnbOZ9GNo
nQDb3OHLI3G1I2uatiHgmtiR1mA5x92d
9ToAUgp2km+V4DZm
g7p+hvVZfF5uzCnb2q4arK4=
vRb3CHLaadwIR5hRenMeXZPICp9Y0Q==
w/W5tGHbIsz8Ng==
db51Oegk5zuCrk4=
clAyYBye5GVS2S9k
oKZupODcGwWawGOqtiIM1VaJF+eS
UWMeZAtjxGPy1uNslg==
FjQMVxpz289hgfIGG41JnhLE
xRHV1mXsIsz8Ng==
kKF+zqwlvwbvE3pxk4AAu+0gLO8=
BhT+EPfMRbJfLIKqocR8lAZl+t2L
8uG+Ke9nnJCA84sjZNQbW84WGw==
EzjiMO91G4VGROX9CHEwJZlOpIuDiQmY
ctiG27k9em6V4DZm
3DIJFJww4juCrk4=
JWpkkpJjjm57+8xSiA==
2xHS0Lyix/2wuxbES0E0dA==
yNrRPAeHxK+QGmyQ24VJnhLE
+gHvBGa86Bipg9Tx/q4arK4=
F25SwgDTVZn5GDts
RWo0Z6yz9zAb3jCjELE=
kL6guzDa6NpQMw==
O31rt/nfElgbGnXWGrc=
pezVBSvxY8ALd5q2vdaYpIqJF+eS
2dqe5RAFFPhYSuDL2q4arK4=
SLGUwEzogcvI+BCtzK4arK4=
azuregarage.biz
Signatures
-
Formbook family
Files
-
1672-67-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ