Behavioral task
behavioral1
Sample
1928-138-0x0000000010410000-0x000000001043F000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1928-138-0x0000000010410000-0x000000001043F000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1928-138-0x0000000010410000-0x000000001043F000-memory.dmp
-
Size
188KB
-
MD5
72708377b353216db62ed14676005a33
-
SHA1
94dd5ca43875d85367ac77f0903e3e3e32e883ef
-
SHA256
177f24c79a859642f01e32824f8a0e0686eae209ce6b7aa1753ecda60d0267f2
-
SHA512
ab73c490a733d759da6dd9f7195dc406d260cf3ed04207011ac818888a6db9cdb81face13f16c18f9aa1c6aa42794c2f4555f438813d9756b52e67faeb143c73
-
SSDEEP
3072:1IhUoaLQbYAg8iMNgW3WL6Xm+Uh9TqKRiDXqYvXiWIhsdtGXZma8Q4JcEfPMJ:1IhkQlBNxntUbT8jrvyWxwXZm1Q4WgUJ
Malware Config
Extracted
formbook
t3qw
cmv2ztfryZrE+3A/E6XVJY/zH13snw==
znM2r24wvyjMBxCX
RH+7M2Ut6PYms2mB6ho=
ZlPRueq+YTIhbwootBU3h8T3H13snw==
cVz99xUsBqvFN6B45U9nio0=
BXU3DIrcdhs2gNyk+lCCIoY=
uzBaz3kYIIMfK6V0Mr9FnhdNPg==
8rOZ/v+7fprLI6NzR+6HJl7EH13snw==
Pr2Wev5P6jlqWCiehQ==
dbzaPc5eWb5zVCPsyrU/
IeLgUQI37HLkFgKO
4xt3Y4yVega6l2LuLk5aovIhhLU=
2QdkbxFB8tkDMkQEyqg1
X1OV8wH0+lwCBwvIciO7Ug==
lYIX+/YAFhbMBxCX
DoxOV/qIixyT+HME6yyvTw==
GAuVkyRmIgwqdeGgIVU3iY8=
VMPRWwSKoDLoqJJuQ3B8kZI=
SAy2t2O1YK0dvad741U3iY8=
OOLZqb+rGSobYw==
BP6KlsGwlrtVHv2LuMCmeZX1
JNnPIbb4mv+inWlIfIQs
i4q7JR4yRCpVjDrXkg==
7d1ZKi1DVjJW0WxEGcBkFXJdkb8=
NahiXwI247vhJ7KMpwquVg==
GUuifI9mMMd3YkgEyqg1
u64xBRXWoLdn3lzrlA==
lGMT+jE3LAL0LoZMwEG2TQ==
adTOQvF5fA7FZd1d3FU3iY8=
/LGF75n7qwdqWCiehQ==
pSZKpi9qOxrMBxCX
H4d//6AZHEEnHhmV
PXLj2/vIWeKTTxeSsqNntbghfTKSgPV8GA==
87y1CKHld806kQ7alA==
a6j+jLaDUF6B67iD19OmeZX1
BDnu2dfk/hxMTA/Niw==
ij31217h5DUh08Y=
tleGAKk0L4nvpKmcdknE29T9
KNyadIZrGSobYw==
+HZi64O1NMpx
2oVLG2r8sIV4
b2cT/URJK5hm
TLvPQfs/9NHzMoQD6yyvTw==
tessj41B14Al1cU=
fvOpegdiN8Y/+9xpkn8JGFR77BLu7vGMGw==
6DdbojapWcBs
OzlpwsiedM46wr17nn0lfvEhJg==
npfZQ/iFlvyfjjXirA0=
14djR8UBxGDMBxCX
w61MS3ttGSobYw==
tIeVD7A+M370sXFtmYgo
P3fa1gYE+CK5cELcHiweOIfs
7TdS87b3eVyEjDrXkg==
S8+Rae1YZHvNScdT3FU3iY8=
hYDFA5EaC2jMBxCX
bi0zjB+moP6gpa42NPlxkJfR6d6SgPV8GA==
P3DCHSDkoLle18c=
zD81ny59PDooXs5e4VU3iY8=
szhcykfHqbXqa0QPeL/ojdg0YByIgPV8GA==
69dJPcsKwJWs6TGnNsWCm5Y=
q5ISFURIL7InoeUp6yyvTw==
Ob6BVcsfwhO0s7UrC64+nhdNPg==
Rnvty9PbBhc/kcyR1gs9TJ0AGuiC
8Bt0U2Iw+Yo0OUEEyqg1
thestillout.com
Signatures
-
Formbook family
Files
-
1928-138-0x0000000010410000-0x000000001043F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ