Behavioral task
behavioral1
Sample
1992-77-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1992-77-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1992-77-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
a244632b14b59fabe1344a6b90b8006f
-
SHA1
feb6f56d430e34773fa993e48a08525d8f2ce6a9
-
SHA256
57c590ef1a41fd468ee4ad6b7041671dc90d84fac7144706d1dd5d0a05b6cb17
-
SHA512
9cdeecbfffa528f9130ef11aa2db3f51c05544ea7f0472b13c7d105c91e53c77fd62738cba8c16e037a4078878ced3b0a63d8e0f480e55ea8478e58dd287c77c
-
SSDEEP
3072:bBrYDDjU/T7bUPlFunNgWa77DvlJ0TQUt3puUUG0uhF2yvrr8qzPBNdiZQ:EDj6wuNYTf0M0ZtUG0u2WRLBNAZQ
Malware Config
Extracted
formbook
dqup
RBFKWV5uGrUdf6hN
jGcsTVbthgGRPm1nWzyE
omvIH2jxGd0Sn12CYeAAIvEODy/o
LLuzSX53kGpef9bObGSZ
P7qPqZmVr42VH9LObGSZ
EeWGEWEDxEDd5U1TxRw=
c5/8gdte657s7yo=
kQyJz9WGgKAWCTU=
94EXa2L/gCuXTwVF
QwngPG0f95paVrPd/TEdsg==
AZ0qhZ0icV3HJCS8tw==
tYe83vwj5a8uN3OSZEC+iZW/
aCkNaXAMOwxp+/X+MA9RYTs=
RDOfhwk2ysWuvw==
L79DjZhLdk7AqW/ObGSZ
eAP0idjnAen1II6+8TATqw==
d+/2mB+UWxTV2F4IsdJS5DE=
ZR9aco6xbRNvaehuqA==
zJVFYGnffyUV75T6phA=
yV3K3+jViRAtzJDNQThu0lZp+2FeyA==
m6pvyfd3NPXY+WlimhUCqQ==
bQfpBxsYEOG/yEoGvc8RvA==
21FiBUr/pTrYiI7iWTaA
R7swzhebvZEKEZVvsBY=
BrlKcuTqormjtQ==
fzFoh5XFgw0tzZy/8TATqw==
MhI0ySI4TQfyHI6/8TATqw==
y5fK9PMMMQPwE5HPqx4nGGmJ9w==
HeWd8DEKfA++ug==
dfZ2FGjWO90U
NTVDmgkwyMuy7zI=
NrYZJTjhppgiLaXnvg==
/MWD1SkuTyIMJLBcrjlz9TM=
YzteAV1dYR4ASG6poA==
dzXrM4J/jEMMSG6poA==
Y+/jNm+Zr14QMmx7ZUy+iZW/
d/p9H2udSeko3KTA8TATqw==
NAGQPsGMq57s7yo=
55/n/QwjzVRBU9yVEphRGGmJ9w==
0IVehYU4ZkXFbZVvsBY=
FUVZdnJvGLUdf6hN
vzw+1Rw3+4GhPV6f6lb5nSBlyXs=
oyhFbV1mezPzEExhiPGvTY/xJp5GuWU=
oiuzXJWjMbUdf6hN
TyDXH4SZcGMHCzc=
i2YbYbBhEa1p2uwRXdBVbjs=
Vh1I3yxJDoOISLvjvQ==
9n8Ip+4m7Zi0M+HtLx8pGGmJ9w==
WlvH76CQxw==
dRQVaHCFqoh2mxFQXsplAUlntdutuHa+Fw==
ZjeR50/2uDnfB4FHGQdtdDs=
ENaAGFfYBuFH08t37eD5+DhSz2w=
5KsGJyVdNMz4dXogcUyDnqQODy/o
3bRriKRNysWuvw==
L/KTKG6iYy6RMSQ7sdJS5DE=
BakOJ0Lhii0BSG6poA==
GJt76hWpVCqENidVMR4=
Rw+mOYgkTyaiU2TObGSZ
oym4AwmBIc6krSW7/Hhd80NA1ztBdFewDg==
4qdyoJ3glkGWPDZfnzlz9TM=
rX58L6vWO90U
8KyP5vl1E7aum9/tMZwnjFCn
pSEsw1EfRRz+SG6poA==
if2Vu79NysWuvw==
xavi.wtf
Signatures
-
Formbook family
Files
-
1992-77-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ