Behavioral task
behavioral1
Sample
1144-67-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1144-67-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1144-67-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
5de474e4a504d162e407adf28cd7d562
-
SHA1
7759153191f922545baacaeb1c74844109dffe4d
-
SHA256
a003413c44e421410162b17ce6242d3220a763a9e1904d02c21f8adaded9a760
-
SHA512
0fa49942cd4c7a7c3ca04bfcaa163217553b9a3ae32f94148fdaee33cc5f8654315b251449c5b5c1b20350d32b209cebc15e82d825368a867fba62028a5e38e2
-
SSDEEP
3072:CQ7LYngy+Su3sHAWzj+7irr7yGMP5KGNZlPRNbxrlXN4LdWUYszOq:TUgNSrHFjHHyVR5rlPRnJI1YH
Malware Config
Extracted
formbook
pjbh
gQzM2FOqwFqt
1ZwAvHT6GUxrHykH
QrBqmobTZJhw74DTI8Xs/KEXyyc=
YYX5tZAuItburQ==
0jnoH/cnyHf6OAnxcpbScj5BGEalKw==
3YFxbRpZ6f9WBz8=
G2nqn2msEaf1V/Zgc0h5ng==
fDJEZF3yHBgt4WjTMfA=
+xnYDgq2d2JjI7lLxGiPh8I66kCZSHNG+w==
R3wf1L6NoVSdjZZhmbYoaE6O
w3UyZMQBDI0omVc/prcZior3CgpgWXN1
+L+8+tqg/gHysA==
0uIj89AheWSzPF8Q
9YcQ2rZSAe8AqgPU4PIZ
FfIExRukeoqrpONGoUp4lg==
8k4YOvaFXW1gnaAxROQ=
qgaVWEPyF1BrHykH
N1KSLx87Z9hzIKAxROQ=
DX89dGyrK2dC9D/TWA==
yUMDNy3L2h5d01riWg==
Pjh+9U7Qn3pQRf5ccIGO9TYsQQ==
3dwp4t4Fm1WiJNzE2Okl6hA=
4lCc+nIEGVcPkSaKxluBZNkKrSQ=
REwhURcGNRMpITAP
f262QK1CTvbrpw==
uAqlaC+aPigzYTC7CT9ZqG6kgPlFDEcb5Q==
P6laV72SEdxG9D/TWA==
FSNaJ1SyOv9WBz8=
GAVB3tSPzFqt
UxInGNl/PyVd01riWg==
rzbp5EJB4t8WVFEa
2ya5g1WG+f9WBz8=
HKxaRbulLVwXjyl4x1qM9TYsQQ==
WoKVzXetDLw35Ww0cv0=
3qSqoQcEtOCgDT8dMd0oaE6O
7LjR+O5Am4ZG9D/TWA==
SXIIeijx2FPChgNlumKGbtkKrSQ=
97zKsl/15qNw5yY=
lK7FynAeUtR2I6AxROQ=
/hBVI9NYLjT2cf1ouktxcglORAVPyKU=
auapnUmHItburQ==
Qnx6uUuuncbMAs1NocQoaE6O
t46mlVWD7JjvagVgc0h5ng==
nEJHBxzqs/PJwYgP
AuYlkkEAGdFwmaAxROQ=
cmY7hGslGLBIeE8nPqMP5hY=
Al/ssJcyItburQ==
JXItJNILaXFG9D/TWA==
vMYQng2ev+vqESMJTXGR9TYsQQ==
gdnXgh07aQ9XExLscIfQO7WoqDM=
Qmr3xKP9m2PhJisnO6MP5hY=
N0IdYjzt3gTz9D/TWA==
jSbqEAOnY1EKgghdc0h5ng==
SlKONu3nObPh7exlnzx2YtkKrSQ=
DEeANJ6xEehsZ59CS7IoaE6O
cMxPF8smNehrHykH
7G6yVgFxMkcQhgSpLTVNBx4=
JHoBxFEtqtirMaAxROQ=
SSZ1+E9uxatg1WTCaYCYSKnuAvJ2
nw3CtxgZSmVrn2bRIwQoR7xtSQ==
bhjEPZ8B/DAG/sAzc0h5ng==
qSL2Khu3dWNvJ6EvvRSyrtkKrSQ=
gN+qxIINN+ZrHykH
a/WzpggXu23yr/rJ5neajMFA5peVaa0=
mrdc.website
Signatures
-
Formbook family
Files
-
1144-67-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ