Behavioral task
behavioral1
Sample
1972-66-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1972-66-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1972-66-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
63bc59a1d1f46197c637bb67615f06cc
-
SHA1
2a5d949947f43da600843d813beb800f27a01491
-
SHA256
fb167b8338bcb8b2b8e20befacf73c12d91e4f13bb278593f7aa4869f137ac2a
-
SHA512
14562696c3d5838b1538d784e352760e703732b0dd94374c071c196d7d3d516d2b42e9c03f8f8eab260914c264c97b4de8fb5204e12d6e064a2e74f410cc2233
-
SSDEEP
3072:7R09r0Epa4aekon5M4nxWZZ7fLIc3Rww+a62zkrsWqExsEiCB/TIF2bPSbH:XePty4nAZp3R+qzkoWqEnSHbH
Malware Config
Extracted
formbook
qnz3
2SzTdiRj2Bqpt2yEsA==
RHRYWw5yAtqbMbvugQ4+OhEZ8+pxl+g=
7SwvhkR5TuY3grUE
YoeMLa7ds03QtqcHY92b
8jYChPgg+340v7kfsw/mfgOFSA==
cqCJrrH8wABK
zer2hDyaKEM3grUE
yxTjblvZeaqENXUHY92b
S2M0ajqchQ7Puuqcpg==
LkH4I+piASsvbm1/rw==
YJqZJLEd9cocVg==
ZH0yUvozmqXmEE7LG2wKluXL
OGZ2hDmdIF2jy1DXRrOG
6gC8RwKEP97mvTOtL3l0sPHeYINt
CTQMIJrInVUXC0ODvg==
4A6kx3m5mDY6Ck3LG2wKluXL
dBZVekz49cocVg==
Fh0brGW4NUSDms8nx0IZo/4BsXyEng==
APCrrSMe2fxJ
5WNngwZFGCTWuwd5C5e55V8VWpRn
uslXlNnOwABM
ziTv6XDTeKl9J1PLG2wKluXL
bpAgMfaOYwqTp11vow==
vfj8if4r9JQNSIBj+W32dTAyNuE=
0vrKUMcC1BRnnNkzzU1OKSGRavw=
kEnQpy538wYPfKyDqw==
Fj5NzoHnj9IjO3UHY92b
leS+RL30YGq1t2yEsA==
MDwOLK/t2YucB0ySk4M=
sMzL1mPZhLfzE8fS9uEmLgU=
L0QORv5W6BVke4mwWPRBq+bM
V5JYfzR/9P8/VFxWbEWSE+aTVg==
tLh5e+Lxois0qac+SRYjEQ2Jz9VZkeg=
ByxW9XjMaJBatwF8EIs=
bpqgV0rOjiCys9gYjeG2fPu8mqJl
zwgSvHlbKstd
1gYbl1HLXqeybKLabr8+gI8zsXyEng==
Kj7S4J8t5iw3grUE
QXCGqi1kytwoR8ix0ZQ=
QmuEjj6KBhrZaGPWquPhlR4=
THhJY1bdkickNz6Avg==
cZyAIKPlc5ZW3Q/tIUQcJgM=
whPollrJdsESod+urw==
D1xQ0D5sR5ynE5Jm0HO/AA==
IjC2vmrKS46bbih6MK2G
g7+3WdDxjYsSTw==
A0hUVhisfM6VCkySk4M=
YYG1QwN/Lb39fLGVvZXYCA==
DiAe2GB8PuJsTjsmpBPRE+aTVg==
w+qJfPEzFGAb+oJyD2nfGQ==
O41iHCbq9cocVg==
N4xWzrFHDrQ5dKSLpJhpWBo=
jArHXuIs9cocVg==
DCDxC/uFKE0INz6Avg==
NlxohxR2HF2otusqnR0zJyGRavw=
eM/b0MP6uFU=
0yxKynbgeqwBGkzAZLRlzQa8mqJl
PFgyU0LKwLl9Dh3TG5CHXhk=
KFgtvz+RMLaudasHrwkMde7a
u/j6gj01Er5Y
cIJK+LEJfbIyJ5FyqQ==
haA0Q/ZRx/4Ui400XUEqrv28mqJl
zisB+3zcbLrSRHhOcZhpWBo=
oOaqWRRfSQG1jpc=
digitalavar.com
Signatures
-
Formbook family
Files
-
1972-66-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ