Behavioral task
behavioral1
Sample
8b6be142c575a529f324fafa4ddee5d2871d8aa83bac03cfeaba4aaa87b00fdc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8b6be142c575a529f324fafa4ddee5d2871d8aa83bac03cfeaba4aaa87b00fdc.exe
Resource
win10v2004-20241007-en
General
-
Target
8b6be142c575a529f324fafa4ddee5d2871d8aa83bac03cfeaba4aaa87b00fdc
-
Size
184KB
-
MD5
63d036d574e0eb90d9a193c0801ae939
-
SHA1
09bb1ca9258ba90202e9d3f5a2c019794d467e02
-
SHA256
8b6be142c575a529f324fafa4ddee5d2871d8aa83bac03cfeaba4aaa87b00fdc
-
SHA512
2f707cea67e7226ca774cef92e71312b8d039d25819cedb617eac9978e9d55f8fd4cb21114b660bc8401495aafd7e36a8596d81f5111b6ce631d9cfc216c4159
-
SSDEEP
3072:DbTt0OVkMlZXqJWYfz4AvwfLAWfVOFkL2UhQLSmp79lcBGocDXwZT:LCOv/q9f5yLHf4FQfhuBlcBGockZ
Malware Config
Extracted
formbook
fbce
Z4SlvN7wcIB/2gY=
FFxoAMtxrL9l7g==
mKvH23KL1Kkslrophi2XdTixtw==
ts/+Gjx4QSxh2v/2bgWSdTixtw==
1+wJH6lV4UJyjr7vbBg=
yR65207vjV/6Q6UHbA==
Y2Wer9IX36etHIQvahE=
m6bDwG4ZqmXdJmxfulNdSORn
9JCvDS+6rL9l7g==
h8BVhgCWF42kNWJ0kEEG
E4cgTU/1Dd/vUGxctFFdSORn
Sas/mUy2gu3J6w==
gXrJPNkWYT9+yAM0LxuSOA==
uwi39xAk3ausGIQvahE=
L9UlTdkVJI0sKFML
FRFTqk6M/uOMHTt+s4xkLw==
frH5Cqk6Ze7X7GBvzGRsUIa7/nAbM3l4+Q==
Woez0ZwtpgHbKUQrZUwMgDI=
ODtHQ3o5PY0sKFML
lrHa5P2LmHI5d5QRLxuSOA==
lr9KqR2Nh9JJ1fMfcw8=
RSZotnH/lX7XJoQvahE=
59sPXgBGZcU1t9IJTPYu0KrvRSVjlgA=
we9zmo81SchkACtv2o2+dTixtw==
1RNOWvo7eUr1Q6UHbA==
Nl1+qHMKsYggxvw0LxuSOA==
Ookngipwu4Ydu+MWbkwMgDI=
lpGnkQoxcU+Gqu9bVTWzZlBv
FAkdQNzrG/RCk8H3aEwMgDI=
K03xSvg6RlLXDUIJ
RF8HUNh785SLvOkLdC+WdTixtw==
qWhvnzLGQOKN6RM=
6/kX/Huz5EYhQoMHLxuSOA==
Ky5hwmSorL9l7g==
70XwRGl+SjcBQXQOLxuSOA==
lzTVQIbHbkPfWIhWiDajOg==
+UfFs7xaaTQASGgTgCqiKSicqGb3JT/Z8Q==
pc/3Chcp6rK9/mR0kEEG
YUVLNMZV25Ulvs33JkwMgDI=
ZZLTCbTxDYz4OW50kEEG
DzKCwtTxv42YGI5Rw2kb
qrc9eRBHZE0M9U8D
pOt+v+ZaVilf6yUZX0wMgDI=
2GUVavB+rL9l7g==
i9kxL8ALZlP6Q6UHbA==
qv1Rgitx3bLrOFREkDcyfRmb7h5b4OPT
IjBQaYvOReKh/Bk=
HaxXuliMx5gtvNkIaEwMgDI=
AxE6P8byGbhr0wYNaxk=
UIXQ0E97WrsxR5wRcQ==
KEDAJsFRmK5n8Q==
7VPsFgGMn2+T5U85XTcA
TpUVPneiZ0RoBD58uFb+7Do=
nFxl3gcLTMEV5zYBew==
/2cbXSonOw8O6hIBZhc=
W4SjjjbwcS12tPs8hCpg+u/rR1o=
Po5DlCLBQOKN6RM=
y/j6V91zrL9l7g==
CQEXBEk8Dfm0
Plt3ZvlBkFbfWI10kEEG
CzhVfzNnxrBPzAKKBqOiFMwjaTB1xQrD6A==
yfssKyhKld7L9U4T
U1Zpj6/1kWe9HIQvahE=
J28ffR4g2cpAQ6UHbA==
kankan13.buzz
Signatures
-
Formbook family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b6be142c575a529f324fafa4ddee5d2871d8aa83bac03cfeaba4aaa87b00fdc
Files
-
8b6be142c575a529f324fafa4ddee5d2871d8aa83bac03cfeaba4aaa87b00fdc.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ