General
- Target Profoma_Invoice_SWD173647_3vey_REfR-32JdhY_PDF.exe
- Size 508KB
- Sample200811-ddfqtrz35x
- SHA256 20000a9d0078fa18b60d9ad52d36b4f5dfa77d2f74866e8793ee0085ab0c9964
- MD5 7ff57c60b0cf3479a387050c72f4bde9
- SHA1 c5b31d3d22f2d5ba063321148b0d8ab40d93bab4
- SHA512 8996ecd579b52c41825810ca8cde70e546d7cce7ee0a882568305cd07ff1a1d47677736224039569f693f485d3ac51c3ff681069acacacee149375ffae507283
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Profoma_Invoice_SWD173647_3vey_REfR-32JdhY_PDF.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.flekcht.com/f4m/
-
orphanshop.net
-
banbietchua.site
-
seafarercanvas.net
-
featherandfurpets.com
-
midaowenhua.com
-
thetonisher.com
-
d2cplaybook.com
-
26rutlee.com
-
moncriefcomputers.com
-
intouchproducts.net
-
sulkaravelovpd.com
-
lipstickanew.com
-
famous.international
-
lamaisonbleuedelongbois.com
-
hunde-nanny.com
-
bdrdesigngroup.net
-
salesforcemwpchat.com
-
zm67ng9e36.com
-
ohiobaler.net
-
shivacleaning.com
-
creatricedepetitsbonheurs.com
-
71seward.info
-
aidtronixusa.info
-
fractalflowers.com
-
iamtiffanynicole.com
-
vrabuglhdkgmvwgaqpre.com
-
thelesterprize.com
-
wwwty66601.com
-
hmueu.com
-
thehelixnebula.com
-
voyagetime.online
-
smileslow.win
-
ristorantedialettale.com
-
dewangadventures.com
-
nakalotto.info
-
gamephonics.com
-
akustikses.com
-
tvlk-pay.com
-
jsxzlsjx.com
-
encomiumsenttlzhwt.download
-
finddentureimplantnow.sale
-
rickcrowracing.com
-
lingzuishuo.com
-
lifeassurancepasargad.com
-
wowcareguide.com
-
pizzafirelogs.com
-
vantagevehiclesigns.com
-
bkbgroup.net
-
foundmoneyfornonprofits.com
-
findyourkeven.today
-
suanli8.com
-
bbin8686.com
-
952cjy.info
-
americanbestfoodus.com
-
otiumlandscapedesign.com
-
varrado.com
-
jiaosini.com
-
magentamedicalcenter.com
-
adventure-parc-snowdonia.com
-
securityexpressmagazine.com
-
66477.net
-
objetsconnectes-store.com
-
senegalmatelas.com
-
tryseoagency.com
Targets
-
- Target Profoma_Invoice_SWD173647_3vey_REfR-32JdhY_PDF.exe
- Size 508KB
- SHA256 20000a9d0078fa18b60d9ad52d36b4f5dfa77d2f74866e8793ee0085ab0c9964
- MD5 7ff57c60b0cf3479a387050c72f4bde9
- SHA1 c5b31d3d22f2d5ba063321148b0d8ab40d93bab4
- SHA512 8996ecd579b52c41825810ca8cde70e546d7cce7ee0a882568305cd07ff1a1d47677736224039569f693f485d3ac51c3ff681069acacacee149375ffae507283
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext