Behavioral task
behavioral1
Sample
860-66-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
860-66-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
860-66-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
7d4389436bbccdc800a502534f20d6d0
-
SHA1
f8301b8388b61f736776c3aab5c6677149d03f64
-
SHA256
12e20d9e404baa698d54fb1053dd410345a5b7e444676219bc1a4beef043a072
-
SHA512
8eb9ac1be51570cdf978cb33780c54da997813807e1705b1022f7d44c96d63fbfbcbb1d1a1272acbaf680af697a983a9c1168fc060f24b74ab9467ee0f1a7134
-
SSDEEP
3072:yGLLqmznb0IiUsxWKorZq6Xp+9f5vTW236Rfi0ub5mm3yWxQh:yuznYIfsLPEpefRy236RZAMmiWxU
Malware Config
Extracted
formbook
f3ip
xwyzdY6C+q/QlfcIYsWNFnU5ggw=
Bsq+r9RmVzJW
vwOuiIf9/QG1Kg==
Sd75diSC2QbFKw==
GX4TBCbgkGV0OUlMsA==
OLw/Au2+NPMd90mojj6aKUs=
OxwncAdlgXF0GDhJqA==
N7RTVnpayIiv4Otbvw==
fCjVrLmdMKFDmd3xuhc=
vfGOPBBuW6dsJ5MJ0HLLBsuADgY=
Zhc4VG9g3pKziQOTW9Pa1Fb5XQ==
rxXCiOjJOclOPZk=
uXyLtM76vn8nwIDSLBg=
Gq4Sej262QbFKw==
4xQ3fBaSpg24M7+/GQBxmlo=
Qkhk6KYzZ1dGX17d
Ou7k2/K7KvgdGDhJqA==
1tr9a6Y+Tqwz57n31MjY1Fb5XQ==
tJDIQ83iSjdS
++ghplvdAu4XJMnXLh8=
lldvvHT0rTnVNg==
Iao8N4lnsHeokPBGJYf+Fb9Yt20ex4i+
8XQjK1hK2kQI4UZNnADv8tsCUAPbVSQ=
I2wIu4bPBs2C4l7Hn4Ps1ZoS
7Na8AIjYyhep/ESwjj6aKUs=
zkjt9AN1WLRnKyNkalmT
pKjJRiSt97lnzmWqngo=
DVzVWSKimlFxMyNkalmT
7fZ9sw5ehGpGX17d
FMd3EMQSARrYNQ==
pi7AuhZwar1Sqytf5xQHqg==
UcB6icandmIlej5kalmT
pjHd4A4JQg8pHhU+qAA=
59QAgDN6yC3VNg==
QIY89KP9FPwd5BU+qAA=
Voke4cQc9mrmrBTK
fjOsdHnv4fHQ9lLAoA==
ajggezOCl/6sIw==
VOaIpEJP0SPhuyg+ohbqh11mjw4=
KNf0HDp1Kgs5HvoQOhoNrg==
DDpllM3LZj1lVrwExjbtgl1mjw4=
oDJHuECNdMRGX17d
5N7ZNOg2cDHbWKLiQnK3O1I=
P2B8fU56yC3VNg==
o7pTTX+HCMTmsT1NFXcxtQ==
OuBbynW9mAGuM93xuhc=
SIgNlWfXLR0VpDjBp4Ka
3hGveEzI0j3bNIX3/zUdsw==
YRO6fn4GV9JhIt3xuhc=
rlP8BBqRoNvQ9lLAoA==
zQOybDVGZTRU
t+xq3nPf3YxJv6jBMg0YwXIGSgelsSg=
VBMofzGJ2QbFKw==
307VhmLLB8JGX17d
dP+xqLB52QbFKw==
NJ9QXIIYQgIbGDhJqA==
3AeiPdxLYcdGX17d
Q8+Gj8vTa9ObidsO1HK3O1I=
5a/UKMlXfENWIg==
NvjhyeTAXizOKYH+xDAH1D7kVw==
B4Km41aR2QbFKw==
rj2Y1iQTz6J0eUmihHib
597KkmXLuNKUOCOsb1vZpotghgY=
zdIDiTGXgdNtJwJNEfUsWIdUkoRLRQ==
livedme.com
Signatures
-
Formbook family
Files
-
860-66-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ