Behavioral task
behavioral1
Sample
1752-77-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1752-77-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1752-77-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
1050a2e0bb54d55b5d22e0af5da59cb2
-
SHA1
95bcbc7b9ac73ec9580468128f9a3f9cb7b23c4b
-
SHA256
6232bd97d78af706650ef845fef8e3a3f7256b22d529e029b08b782305afef3c
-
SHA512
1fe37ed1310713581b61f8051d868e6da163056b38c8309661051023ed916094c7cfc72cda0fd850f2f49aa6a4d6e4b8319483f342f7d46d0cbb69aa0e3780d6
-
SSDEEP
3072:0SsLrZJT8AmcJnbC0pWN3hI99nsypUkPnp7/etdDKG2SbdpkqzGS3TNGke/:0SsZt/m0m0MksyWSpCtdKXIlGV
Malware Config
Extracted
formbook
54ut
1DeiXmzDLw+mW17NwLBXpXM=
Nouf/qArBV5GAPfIhxWPkDFrVQ==
9OCYganx4VaCX1EY/sUSfRDLx6s=
xh8rlilJ/SGckKI=
HGyA64YZyhUs3jvzno2F
yx7/XhxTuRiTcnLKrrOOXTrpW60=
ZYI6IbtcBFx+OpnLU0nXmw==
MhgenS1xYWYThQgS+A==
s0ada4bHHvtWWbYb
2/4IbaW+Ljsy6Ujzno2F
Z5WdKMj5YLgpH0ypdTEcLe2W/lf7j6Io
xXTmzNjzpvUMwTAHwYv2kw==
kcbnSAS0pkV2G1fXsFktVxiXmLTktXY=
PU0V5f0rnqjEhQgS+A==
Z8aNX4Sm/dbGhQgS+A==
s4bq4W4D4UJdYqqvU0nXmw==
a56Z6W0Asvwh3jzzno2F
Qmhm+fY3o6bEhQgS+A==
WIFCKZ/ZO+dCwTAHwYv2kw==
Nqjne5GxXbzY1f3Qp2rBkDFrVQ==
ay7FwPymWyoUA0koz4X1ehDLx6s=
X2o0F6xSKpbHwurLU0nXmw==
LFYJ2xarhGLbjvHcU0nXmw==
PmYYy+s3o6bEhQgS+A==
rwkKQFvxy2ZiaA==
3XLAIdpvIHb670l2Kqc=
SEcXPl3uyaH7yL8=
nLnFHxQxy2ZiaA==
7NSLjzvlluEAsgd8c2WWZSHl
glxZ3olyD3yr
T4Nv0GzC8Iy2
144yAAQ/7rnd1gbcU0nXmw==
f66mDKD54rYeyC4bzHTBkDFrVQ==
z8zuVQBKuBeKjeVeSsZPaiuoYa8Q
5BkEN0/qy2ZiaA==
Et5uXJROPkMej/HcU0nXmw==
boNTOsBnhavV4DcY93JFl20=
KoLKmKju0hwKt6rzno2F
8X4LUmuxhnvgrxwCvsj0wI5pQg==
NCXlK3yxGXvLNpIG
j66Me5rog6H7yL8=
amyG13MlGoDhqOLf1qP8kw==
X0ZQnCxpzS1UCl/Si1Kzhg==
lJ1rqfJ7IX6tcGt0aV2WZSHl
X0Q5m0GP/2nLNpIG
sh6ch5q8IPyTZoMY8rBXpXM=
2CgNdC9qBGOHeXh8iTfP7u2oYa8Q
9rYlLM5vG6+MO5ME
SvlsJoGP8mjLNpIG
qwJ1SHITt4wt5kpz5pr5lA==
fcSr9YbOupc+OFHFn12WZSHl
8FHEiZjje1jt5kl2Kqc=
nxNLtcdAoiaNN560U0nXmw==
6lbXv+BrFuHIhQgS+A==
47IJ2f0qmHQShQgS+A==
c85NKIjrpn9zLr+ddmTVo1bMtQjwlMteGw==
TwgwfvmZJQ==
JrJKFSds2K6UgbO0U0nXmw==
iYxlaAa2ofzvrr6oXs+WZSHl
rjbeubD0kH4l9El2Kqc=
gYyuLcEB6J7Daokv+N/nPjr7
38bCI5ig+E+2lJQQ77BXpXM=
XmuP6nmb/Yw7OlKveDNEjxDLx6s=
gJGl+cm3aDm4ZA==
yaoanx.space
Signatures
-
Formbook family
Files
-
1752-77-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ