Behavioral task
behavioral1
Sample
1344-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1344-66-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1344-66-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
04c5483d631e8308c1e8e6c4ad3dfdec
-
SHA1
132dae4184eef1134d6e1b7eb04e69c1981ff9bf
-
SHA256
f34bf36985a141dc738d0ce4c2dcfca0d245e84452f7f17b86ea68bd9aaa16d8
-
SHA512
58dd553e11b8d5c7361f3aca4a78afaa29b45e8903f45c29b27e0a9b1684107ad3224597952c8de0e96f60fd22d5403a151620c25049b0d8ee8c8900e1bf3b92
-
SSDEEP
3072:9VZIQc1S3sEIneNgWNNbupe/fRyAopivVRosFNDgYcbDDnV3nt:VIS3pFNfCAfchyvoYdRixt
Malware Config
Extracted
formbook
eaa4
BXidUDmcr2VEeCagiW0=
4so/tiJsmUotVSxwQCcRmUR66+Xm
7nShJts1QSzE898=
tVLi+zJ75d6u24t+yopXQQ==
5qGoVXdZjjnwEQ==
JReNO+g2Seu15HeIDqmdVg==
wXq0Vi+byXtGgyMbQRx/YYE2mg==
AyVRVaae3SgIReQVOfPV
qtBV8Mc4MJ1ff0CN+OXM
I0yDLlMejjnwEQ==
oEyDBa8WYxzeGM3oSCjWomcm
6y444gTpDA==
RVGXOiUQk/3q
rnTcVdzh+zIBKQ9ayoJxBnX5aFl9bZGfoQ==
rS625f/YFU8zYUN/DqmdVg==
yT662e7NX6YJrDNQiw==
UNdZfJtx3ta9036EilrDsiE=
4fR4De/fOZ1MfiagiW0=
xMxR7L0nFoVSiyagiW0=
7GroE2d34WsjgW+g/+HU
pjpm2aAhYFU1rDNQiw==
9UCwzwHpE3grmTce
wuQTN8Ezk35CrDNQiw==
kc0OJXxVjjnwEQ==
zMc1yp0RMei83azNsZ77OCQnXCbj
8xhXjf8IVZZDeVCUyopXQQ==
zlDPuaRyj8CkwpOkDqmdVg==
xFfXgb+zGJV3nawKdjPWomcm
tlLTx+vc7x4TQyFpqV1KqAV12MuIcLl5
XoKSnJRQjjnwEQ==
GYCzcHVMkwLoIuQJy6uVRAYQFdSpaOM=
wN4WRa2Sm5VndV6wr1QF8D8=
jdxOfcvFB34rmTce
9JvZlK+pAksWQ06kGg3tYYE2mg==
FKvhnLI7VhYEMRA8IqAT9T8=
DNsdzLofNizE898=
sGumG9mlDYMKY3PLPQzjYYE2mg==
qUqAJROKnybyMzWkqlQF8D8=
QMsBXZEG+H8rmTce
nwBqV0Ibb7ErmTce
1Cabl6QmDIMrmTce
GQg0W+fw9S8mVjmDw3Jk1D/Yd+HZhg==
d0MW6C4VjjnwEQ==
TwRoDcBAo45ailNTQwx7mE7Wd+HZhg==
mu5olMedk4prmUt6+nRnQQ==
pDexWj8Qk/3q
oWLWkzyX39O+6AJYPAN7YYE2mg==
svwzNUV5nwHqTCRolg==
C0SDlxiJz7muzcsc+rsoKLRmWE0=
ZJoIJFM2XJNljXSZ1dQ7KLRmWE0=
H7zyoYXh/MOs0mK0M/jd
xSqjxfn1tYI6WgMD
V9oMv6sQLyzE898=
QK7ema+RsNuwDqGr3Ms8Xg==
ovh4x05HMlVGrDNQiw==
1PQsWcvG50Y1VVW1Qi4a9M1VxXCpS6N2
EI4A6+7jTu+34XWIDqmdVg==
6fp862p1kxylMpQVOfPV
F3G3zy8OGVJGrDNQiw==
jUKvTQeGx4RQfWqTSDPWomcm
Bob12tvSEU8qW1u8FOEEcFaclQ==
NCyhIYJnhsW85sQMTh5/YYE2mg==
rM5WxRsFJlkwTzeEyXVdOSXVd+HZhg==
sabY8m9xtbChxY+gDqmdVg==
mini-loop.com
Signatures
-
Formbook family
Files
-
1344-66-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ