Behavioral task
behavioral1
Sample
472-65-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
472-65-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
472-65-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
16279d77e692900ab2123176102c5ac3
-
SHA1
91227a023f14c394427e061f99f9cf0078831536
-
SHA256
3b60498b198add46f70bf3b8bf5eddd54a74c359699c739beea1db5419c05dea
-
SHA512
b11b6575d42bb0032287c653741522c117638709eb251f20245f5216e28484680df9e06aad4653caf8cf8e69253be5c4bf731e59b4965e35d639b5b9456bc23c
-
SSDEEP
3072:9sbYMLyjOPZb4HAWdxarrLSLqjQMli2FntwlEJcNQYcrkim7:9oyjgeHnxCEqk0ikwlB14kim7
Malware Config
Extracted
formbook
q0fd
6NhaAhRNbmqbve6HFYIVBA==
87gK1OwXYukbwA==
fZCGHjG7YukbwA==
xHZDRoHvON3P6QcAmHGBAV92oYTxl0c=
kjByxz1PPbUrutasMAfDyQEJOxBX1l4=
FawAmlar33VVZAafDRbTPYA=
t56z8myRlFw3cKNVrIGEJxS4
tyY8vmzoQwFK9+lTpIGEJxS4
TCYwo3W76OkaPuRZo32EJxS4
BbLxm6gtYAVO9p3koKU9GQ==
4KIC2xNUSf8kOO5EUA==
QimyTQ97tk0+jDddRh+wjSXfD5o=
yc2xqOvIYukbwA==
B4b8ubnrHxxPYVAYsYZkExGy
230H4/chMgPwSgNYUbqnFaGS5YM=
kQYHcjB1fTFQMFg9h8wn
67UrkwtyuccKMM04K3xZr9sUIPaYNhmsOA==
eAHzG9whgEJzAej6Z8Yn
TiP/CV2kMd+/
SAJQ7bXfw3GlTn//pW0v
WjzSvQo91OVC6FXgy2IGa5k=
A7Z4nxZXHIkTdW2SXw==
mxozfPcdG8BzxnE=
Xe0/Q94QJyB3u3//pW0v
hUYRb0F9e0BvpwjS0Ss=
oTrMh27bOfMfqRYOoKU9GQ==
qZgbzPBOm0t/CvNvb/ylAi9MxIs=
0q7ABZji+8YFnZv3wx0upbCXeB8+
KAbbDJXw46OAivgnD+sxqTVufFXrHE8=
hjvzJswpbh0NSsnWhJEoEw==
cOljP5UXXG3mjhL0UxroxXgvKfUn
BuPqM8dbflkAXPtRVw==
H+oMwsz8FtkKdW2SXw==
sDO4f6TX0oOuRruf0zU=
6cRpYI/O/MBzxnE=
rk4L9ke4D9+/z/wMoKU9GQ==
825VfgU0Ue4qUkT2
Qv3SF6s2k3LJaI1Oy4uOKhhFx4w=
p2YvV78rg1N0QDXw
HtgAvz1jgTAIKN5yfde7G6GS5YM=
7MYUrsBc2onhhXk=
0q6u31nVEARfnov/pW0v
64aV3HOjtIGwPDOIZsvNMaGS5YM=
hkn/Lsj4zbccvB8PoKU9GQ==
3GdLSo7Qx3VQm0NYiN/AH6GS5YM=
Q8NTXLQkW/nZ+CsHZTNj0vgoloTxl0c=
moawOfsmQ/HT9qg+PwVH8iSS+w==
bQCVVmypw2JBYH+DB2LLuaaXeB8+
VS7VCY3mD8e9xhv6fxeWdfc/TDE/
qmaoSziPnGB0QDXw
9bgOye8UX1w=
D9nb3xvPL+cc+s9CWWxeMcv/PERvNA==
Uu7AyTBmvBR0QDXw
/IpEPHKkMd+/
VfAAFVmvwrURdW2SXw==
pinBjq749czU93GtfxbTPYA=
75kPt4cUdTV01rXEpoJLGVfXDOmA6B+tMA==
EMyRuTGjANUK9dU9ccgn
gjKQFtA8e27YfmkJl3yEJxS4
HrIzABYvSChf7lkoiOqEJxS4
lRgnlmfR/MBzxnE=
1aTpaypWb3rXa2Pr9kclkci7tHKbOg==
01jq2hlQjhVNxmk=
d/DyWxU9Js86hnQ=
yxgkom.cyou
Signatures
-
Formbook family
Files
-
472-65-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ