Behavioral task
behavioral1
Sample
2036-65-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2036-65-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2036-65-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
5ca9200426f3c0bf97505b1bc862f004
-
SHA1
af705e8169ff084132686cedd4bd4019dd08e19d
-
SHA256
cb0d6ede9b21d7b26396b2e1329b9ca2d7148a349c6418e81932433e586ab9fe
-
SHA512
466a8b6a0b25e5297f0e09beb332a9d3072cff6a3a1a6282ff94e910592cd4b0acd25b68a145c36ff474e416d8562a245522fd264976568968fcd28602d63655
-
SSDEEP
3072:7R09r0Epa4aekon5M4nxWZZ7fLIc3Rww+a62zkrsWqEXsEiCB/TIF2bPSbH:XePty4nAZp3R+qzkoWqE9SHbH
Malware Config
Extracted
formbook
qnz3
2SzTdiRj2Bqpt2yEsA==
RHRYWw5yAtqbMbvugQ4+OhEZ8+pxl+g=
7SwvhkR5TuY3grUE
YoeMLa7ds03QtqcHY92b
8jYChPgg+340v7kfsw/mfgOFSA==
cqCJrrH8wABK
zer2hDyaKEM3grUE
yxTjblvZeaqENXUHY92b
S2M0ajqchQ7Puuqcpg==
LkH4I+piASsvbm1/rw==
YJqZJLEd9cocVg==
ZH0yUvozmqXmEE7LG2wKluXL
OGZ2hDmdIF2jy1DXRrOG
6gC8RwKEP97mvTOtL3l0sPHeYINt
CTQMIJrInVUXC0ODvg==
4A6kx3m5mDY6Ck3LG2wKluXL
dBZVekz49cocVg==
Fh0brGW4NUSDms8nx0IZo/4BsXyEng==
APCrrSMe2fxJ
5WNngwZFGCTWuwd5C5e55V8VWpRn
uslXlNnOwABM
ziTv6XDTeKl9J1PLG2wKluXL
bpAgMfaOYwqTp11vow==
vfj8if4r9JQNSIBj+W32dTAyNuE=
0vrKUMcC1BRnnNkzzU1OKSGRavw=
kEnQpy538wYPfKyDqw==
Fj5NzoHnj9IjO3UHY92b
leS+RL30YGq1t2yEsA==
MDwOLK/t2YucB0ySk4M=
sMzL1mPZhLfzE8fS9uEmLgU=
L0QORv5W6BVke4mwWPRBq+bM
V5JYfzR/9P8/VFxWbEWSE+aTVg==
tLh5e+Lxois0qac+SRYjEQ2Jz9VZkeg=
ByxW9XjMaJBatwF8EIs=
bpqgV0rOjiCys9gYjeG2fPu8mqJl
zwgSvHlbKstd
1gYbl1HLXqeybKLabr8+gI8zsXyEng==
Kj7S4J8t5iw3grUE
QXCGqi1kytwoR8ix0ZQ=
QmuEjj6KBhrZaGPWquPhlR4=
THhJY1bdkickNz6Avg==
cZyAIKPlc5ZW3Q/tIUQcJgM=
whPollrJdsESod+urw==
D1xQ0D5sR5ynE5Jm0HO/AA==
IjC2vmrKS46bbih6MK2G
g7+3WdDxjYsSTw==
A0hUVhisfM6VCkySk4M=
YYG1QwN/Lb39fLGVvZXYCA==
DiAe2GB8PuJsTjsmpBPRE+aTVg==
w+qJfPEzFGAb+oJyD2nfGQ==
O41iHCbq9cocVg==
N4xWzrFHDrQ5dKSLpJhpWBo=
jArHXuIs9cocVg==
DCDxC/uFKE0INz6Avg==
NlxohxR2HF2otusqnR0zJyGRavw=
eM/b0MP6uFU=
0yxKynbgeqwBGkzAZLRlzQa8mqJl
PFgyU0LKwLl9Dh3TG5CHXhk=
KFgtvz+RMLaudasHrwkMde7a
u/j6gj01Er5Y
cIJK+LEJfbIyJ5FyqQ==
haA0Q/ZRx/4Ui400XUEqrv28mqJl
zisB+3zcbLrSRHhOcZhpWBo=
oOaqWRRfSQG1jpc=
digitalavar.com
Signatures
-
Formbook family
Files
-
2036-65-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ