Behavioral task
behavioral1
Sample
584-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
584-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
584-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
70d4c07c8dd6e73a40b36ae58f30ab37
-
SHA1
9798fe94451b84f17beb1736ec4727abc469615b
-
SHA256
87dcb84425c743e98778e8e1dc1a02116c6592bd970ccff7339e1963e50b2b35
-
SHA512
98d7efbf930e6ca75da290d0d460def6fe8a1ac72ba627bff1b274826eda8a3c2edeb6db7e5cdf3a8884e0cf1af20772abd201a7718603eaafaa7c4e097fb7a7
-
SSDEEP
3072:q87oSdrPo3+9FdKDm1sxWYwrM4BDiDn91c7LPgpJz8moHtMc/iL1GcA5Gv:qcjTTjsVEpibn0LPgph8mNc/4GcA5G
Malware Config
Extracted
formbook
rjwn
03o7kR/VYOT8r06ry8Ku
nhzRGt5dmI+rX14=
fxLQJLh1IdH3jGuZ1KBvy/sK4Q==
GAU9GqrQnwWRKMfS7KTmrg==
xyidkidiZ/CAIrOchLc38Ckd
qpaUZjfKUOAKBI+C1Q==
tn919W/lRcHaoraZK53frA==
zEQOdA3OY/EHnYvF7KTmrg==
MJALDhT0sw68hUTcnNMUVI/EiWY=
FwpKMs0PRYvGVxbSy3mxZtw=
9IBBwo1zU45kK0M=
baAZGqfBu1HmiS0OWuM38Ckd
+fUxM/QxXJmvPfzwdUI=
WZYOXSolDIEOz9lzR0c4UAA71p19tw==
n6Hftzs+TYbFBI+C1Q==
UdyBA9GXFou2hZJ1/W9ihcM=
jrgyH63jDVl3Rg3KVAhYg8M=
74f/sGdLgw0RrxLszsOs
rivUOgDVVdIGBI+C1Q==
eZ0hfm//kK/IgQ==
cOyWB9nBcLJgIe6MJJvysw==
uuQW3nDB5zE515iu7KTmrg==
kFZItj/PTXLXvV/8
SdWV6XEb4CxVA9IKhEeUMtU=
ZA7+YCScoo5kK0M=
xxqaB+Xv22QHm3sV5tiojr32e5kr
we10urhAkK/IgQ==
xHIjiT/6dZAk5qwj/e66jNIRzmJfb+4=
tpqPy81EkK/IgQ==
H/oAAuNh2mF6Ee0gmT6EHyc21p19tw==
DhpG0lPF+kwtG+IoGEo=
rkbubjj5dfvXvV/8
MhD5hGFD1uWFOUCE+nhi4kjTm2c=
28ayIatEvUVU/vmry8Ku
44uffAYW0BW/e0qry8Ku
+oQ4mmlmUY5kK0M=
9z2xkR1bUs1K3oWu7KTmrg==
m2db2VOl9S+XaWJdMWOm
73QkNsjpCEltIvzwdUI=
sW9l0ms9+T7Wk2Pxyr0ESkjTm2c=
dQm1EeTrtAeTJQO1n6oFSkjTm2c=
MMqG+Lp7YV/khkury8Ku
caIijU4NhQUdwBwjf1U=
DenkusP7awDXvV/8
rd9aXuDl1m4GqU5/Cr4sLQEL6Q==
j+BfT9DNkYp7KVQ=
imNRxEzwW8rcoVSry8Ku
UwClcUVdKmf8
2Uz8cjgFrA2TJcXS7KTmrg==
6WYjegWsL8PUjJGv3FOjIUjTm2c=
t0L8aveKFCI216+je6z3sA==
iroxmGIq0Rm3d0ury8Ku
YHi4soTzVY65ziSry8Ku
neFeYuPHd7n+v7uxi80sLQEL6Q==
jfm1IeWzNK22a2qCfLwqLQEL6Q==
LF/Hwz0h2Su9cGUbBgT1BFFqRl8ug/iX
pZvZ78UYM3U+0H4B0xRqVR0S5H/8vw==
rcQA7r4oVYmULtrS7KTmrg==
RX73/YB1XulzJPzwdUI=
EZ5jwEvwdgkluZiw1KBvy/sK4Q==
+5ytLx8LkZDGBI+C1Q==
N+/jWNuSgsXZhw==
6dXR+ICNgA2vR/xdkd0lMsgV
Qsh6jhYVA5YvtYwqAQk38Ckd
volpiventure.com
Signatures
-
Formbook family
Files
-
584-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ