Behavioral task
behavioral1
Sample
1476-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1476-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1476-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
ab736b55d40e21e78896fff47f6f6486
-
SHA1
916fcea6480898cb74f48663f0c61deb0200b7af
-
SHA256
a1a7c2ff9794bca1de6367d24f1322a75e9670d74afb8f0c7503f155fdfa5fc9
-
SHA512
40d51b743ea1f032be6cdb7d58d005f01ee5eea7edae359933ddd02813980c85d47aec72f2a17007e9be04ee2bf960028513717eda537ce400b0a4b5315f46f4
-
SSDEEP
3072:G9ypGcz0VpkobZ4hTJWJW4XAlrLCQqIAW2q9tpGExZ1tGaXcGN8nM4g:G9wAbpahTAEpCdq2MpGExZua18nM4
Malware Config
Extracted
formbook
uxpe
a/CzoooH+7KLDxBh
pxq/4D9rqoY0CaqhS2ZJ3MoWxcQ=
54a97EJkYRruxKJBfg==
afibyRo7bSK3cepm9suqXQ==
2kIxy7hmdVItO11ceeC9
DsTkiAgZVGD7jykdq/ZFa8oWxcQ=
euyGFrS1t1r0xKJBfg==
ANUDttiRvXoVxcknM8L7cgli
vIWhu8Bb36VDR+udD2O2cn8=
CqdCYLyzwb5fWRlX5kY=
cis/39CB6vGMg5OqTrUoWvz177Fk
tl6GKyac14QX
HMzbyJUrUh3Ao80fOcr7cgli
7yKNGCGy57KLDxBh
hlormOKMBCD8uyrMw9QkUg==
3r/fZtwBUey8xw==
vlyJEwWudUHi2g==
214r37lXtmpLQWC0snrI5gjDdR0mPOKnDA==
YS1hgtPl0lz0xKJBfg==
3pa6XND7NgJ4Y3uxqO0nPnY=
/bjdy5gsVVAf7xyXpHT7cgli
UdR+sC1vq5c0RXXFw5Y7DUt1
KZo42bxusIs5Yfm1w9QkUg==
mzfJ0kE8ZE/mjaG8FKqk
Ups8XuzCUey8xw==
bB4kayDLjgkyxKJBfg==
l3hphvgpfEcWt2o=
Btf3q3YMiGQK
/NPnq5wMiGQK
ejX9LrDS15Qr1VclcyiKPU9A4sw=
pEw+tjRj295uY+5tpKjs/SfNriQobw==
rln8Q8CrqWkM7Ka8jNmAOGE=
F9y8eIAiikcWt2o=
Lg4wXbLQ13pEL1WKXsf7cgli
yDXA2lV37iDtk7A1jntP6PG2riQobw==
1H2BmY/47kcWt2o=
EuoIWMG1t1r0xKJBfg==
yHjrpQoPC6958E/7P7Kjiy99Dg==
puuXOvucWyO8vn0=
5IojrjhcoquEUMx5oXX7cgli
TcSLIvx4op9C3YOWXcL7cgli
qhf/pptCOwChe6e8FKqk
iBC0XEz7KvWYe6W8FKqk
ZFYPRW7rt3QU
b9Jw/j9oahfqpKK8FKqk
xniJ3paCbi75xKJBfg==
womnnoYN+6qLDxBh
23wdzK8hA62LDxBh
+LCIo+gIdXwXsd10xP063MoWxcQ=
ZiZHOgOMYvN+bv61w9QkUg==
FfATQZ29uDcZymg=
HcB/rLVHvHpAFjzEw9QkUg==
kA66XyvB+vzLhEXwIFE=
PvffwKdfzdp3aXdkqIvJbAhq
cmaDo6pJl50ut6u8FKqk
MhAjtJklWhco6Hc=
wkvr4yZR4tq5KT+emmus
vpNjEMmb/g/iyw==
vpMnAtJbFCTzu4cjNbum
zFj4hWwmViz1jyL8g+ZCasoWxcQ=
DqBsh9jzAslhReJrY7UeRQ==
Fda0Pg2jDh27p6OzbMf7cgli
aQTg7NqHz9BveRrGw9QkUg==
EsybRVgWiEcWt2o=
creacionesandrea.com
Signatures
-
Formbook family
Files
-
1476-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ