Behavioral task
behavioral1
Sample
2012-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2012-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
2012-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
00a5a7ebe0fc1c13a557542c363c853d
-
SHA1
790aef1b460f9ae2c5e007fd233ef7684526e82e
-
SHA256
55bc1ad971eb6fe34da609892e7b662563d3bb61900b3bc5d70ef8af9f45e705
-
SHA512
5b8973313d44fb92a706390079c25843ada6a6cb183d56b446b7bf63f8550f6c83d78142f09bf43ab68cbbd5405a99b4b3e930ee611267259fda88646cbc9f28
-
SSDEEP
3072:47qv1rhp3z1tfT1y96sWVyY1O6AE9Zg57fiqLn2I6P+ZMorI/YSlRAFV+J2juh:Jvx7pQ6/IA9u5zRn2IrZMlYSTKEAC
Malware Config
Extracted
formbook
b9ho
gen8h8pM3b2uZoEL9K/DumKnqfObXA==
CkUWMlWh4G5tI7XRcRcm
Z8AiskEBCH9LFrqhh/ZOX4uB
4BLw+uVgkSq+pjMQ
Kf/uDQQ8RtW0s5sm+Q==
pQqHIJ5njyH5snlBkIvIHY3hqxQ=
GT8bISzfiVMRudlj9vRIIw==
MHf7EP+3UAjTjlr+u+8=
jnpXNS/iIZw=
WrohsE8SyoZk
Dm2Pn4BHHap5
Ty8OPFYRxpRO7flV6hl+Pg==
lt0ovO+anSq+pjMQ
RY9+Bzqp7YRD2wfRcRcm
seI+Pfj+sXhS6PQz9+dHV5bwly06VA==
UYlw8zKfvFIx7IyRR0LEWqA=
Dnu50LfwRyMcwWBYHVSMs6uTm2XszwRU
70GJLtj+pnI70WY40Mr+q7c=
JPnzMDp+lxkOwXOCQkLEWqA=
GfHRCxBVjU3hoDc=
j/Tl7OkwT921s5sm+Q==
UKc3NeLlYN7Rs5sm+Q==
qg5Xi8/R8YE=
IH/ubZIPn2gn1PJV6hl+Pg==
g+3R6AJR4p5YALvxnVJnXAuL
F04RPVuKnU3hoDc=
1TexPbN2khkJ0YYF6fg=
7DOGDTerNxTXfro1/bT9+SSngA==
pqKHoIbpxo9xCw==
Mi0u0i61AJZO3wuNXiVidCeKqfObXA==
FgNpZhkUtZBH6ZaDbOMRp7Sa
RHNOEqTUbC0LpNRWMNPGAXvbnQ==
mvnk5OkyQsylUlKsbHaFFgk6vAA=
uOHB9glIeTgfz4OBS0LEWqA=
41Nc2kGHnSkZ4Ih4R2OvzgPf9v/QoP5D
a1AAwneo9rFpSLWkefCEgHaG5f3QoP5D
edqyzpGQHu/PkibzwTqFVoqD
lsKh2rjDVBi+pjMQ
8cqXutGFIfzPmkhKH0LEWqA=
w5vk1Ihojxzmglr+u+8=
4FHNatrSCIdrGLbRcRcm
KxGZtMsPSOCgPU3MrKYB+SSngA==
1f9bDlBXj2NZDApVUtPJrtl7wdXa
40+m4++R2mIxwIJ+SELEWqA=
S4l1nLvoJeO5s5sm+Q==
xXABXPY2K7uCUqR3S8gVHY3hqxQ=
V4Fpnrv+MLOHH7nRcRcm
s+xK5WAjO8qVL7GPUcQeZplDqgM=
/GlcW10Dj0kowG5vVJegHJ0za45fsVQ=
TihzCjOx8YE70gPRcRcm
O5zmI3W1Vk3hoDc=
WW/fm8G084M=
f8ou50K5smNJAhx/DkLEWqA=
jG/u3uJjajz0iK4c5vs=
/JRyrnqBrvW2ViA=
G3+Ahyw2dwrrkFr+u+8=
rA1fnbLzMvTMeFr+u+8=
USoElehuuEW+pjMQ
e6Z8lU44WeTGjq8mCPUZvySRqfObXA==
2a/1l/r9gUOks5sm+Q==
6tdbcSgUP9jCaQPno7+1GJlDqgM=
9ljdhRxP/riONVrIu6v++SSngA==
4Brcgw40dAHtmx30y0M1NhSOqfObXA==
Qyk9wkkYK7SAIKiKcimFVoqD
stable-algorithm.com
Signatures
-
Formbook family
Files
-
2012-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ