General
- Target offer.exe
- Size 495KB
- Sample200813-dlk2k848mx
- SHA256 70fce2b9eb9360b8733c9b77032bb566399d7ed9c2fb99b0cf2c823e93485bd9
- MD5 38d5eacceff12cd9ad34966e99005dff
- SHA1 70942d645e2c3eaa051532ef99b6df6be80a7ee8
- SHA512 92772f4d68576eb46c70ce0cd02b7b468f9dcea9f87c66236cf823e7fe4a7d385c43df148f02265c417802266a6d1833eb8e8e0cf668323e0957ae7b5265b550
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
offer.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.fex-tracks.com/xczm/
-
graceandnathangetknotted.com
-
myporndesires.com
-
alphagamingaccessories.com
-
51zhuimeng.com
-
196wrf.info
-
lubanzizhi.com
-
107xt.com
-
jatinangorcity.com
-
tumblrdatinggame.com
-
mtorc1inhibitor.com
-
boogxgenblm.live
-
iotaneuralnetwork.com
-
booksinclouds.co.uk
-
made-in-asiago.tech
-
myfunbooks.net
-
rglrgrl.net
-
azumiyakkyoku.info
-
qasryna.com
-
ara-digital.com
-
barnboost.com
-
vesseladmin.com
-
waixiangji.com
-
reubenarcherrocks.com
-
finewu.com
-
homeworkersguild.com
-
chifeng3.com
-
rickme.com
-
snorkellingcouses.com
-
orendafitness.com
-
thredami.com
-
icastmodeling.online
-
xuankhani.com
-
dup-sgrd-paris.com
-
nezamerzaika.online
-
alotkit.com
-
madisonventurepartners.com
-
ivybeyond.com
-
charitycareerscommunity.com
-
camdenairshow.com
-
theferrellcollection.com
-
kaigofan.com
-
ddgan59.com
-
smartfuturez.com
-
myroofgaf.biz
-
coyotevalleysaddleshop.com
-
danunsah.info
-
inqract.com
-
autovaldepereira.seat
-
tlcsigns.net
-
compassionateaccountability.com
-
buddhistbot.com
-
melloweducation.com
-
cardinalheroes.com
-
xcdysl.com
-
pinechain.com
-
5551005.com
-
keeperofthebeesnwnj.com
-
yk014.com
-
qmailrocks.net
-
indimeo.com
-
importinnovationconcept.com
-
007ind.com
-
markerclothing.com
-
bulletkingbedliner.com
Targets
-
- Target offer.exe
- Size 495KB
- SHA256 70fce2b9eb9360b8733c9b77032bb566399d7ed9c2fb99b0cf2c823e93485bd9
- MD5 38d5eacceff12cd9ad34966e99005dff
- SHA1 70942d645e2c3eaa051532ef99b6df6be80a7ee8
- SHA512 92772f4d68576eb46c70ce0cd02b7b468f9dcea9f87c66236cf823e7fe4a7d385c43df148f02265c417802266a6d1833eb8e8e0cf668323e0957ae7b5265b550
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext