General
- Target PAYMENT UPDATE DEBIT NOTEINVOICE NO. SUVI20-0813_PDF.exe
- Size 604KB
- Sample200813-rn3kcwk8tx
- SHA256 464ffb9a16b269537c0b4475ebe897cc2bb1e0e8d35b0da24aaf21d677a5bf02
- MD5 073069364ffe216c15cf66a0da41730d
- SHA1 4007e0960f791dba1eeaadba5acad5c91e8e9552
- SHA512 6e98b5d8417178d25225b1b4d42bb4a0cac3f530f1cbec07a1cf578a01133d61abb2588bb48342a28e09fb0851cc9485ae3c898e09fb626c36881d6f83eb74ab
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT UPDATE DEBIT NOTEINVOICE NO. SUVI20-0813_PDF.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.flekcht.com/f4m/
-
orphanshop.net
-
banbietchua.site
-
seafarercanvas.net
-
featherandfurpets.com
-
midaowenhua.com
-
thetonisher.com
-
d2cplaybook.com
-
26rutlee.com
-
moncriefcomputers.com
-
intouchproducts.net
-
sulkaravelovpd.com
-
lipstickanew.com
-
famous.international
-
lamaisonbleuedelongbois.com
-
hunde-nanny.com
-
bdrdesigngroup.net
-
salesforcemwpchat.com
-
zm67ng9e36.com
-
ohiobaler.net
-
shivacleaning.com
-
creatricedepetitsbonheurs.com
-
71seward.info
-
aidtronixusa.info
-
fractalflowers.com
-
iamtiffanynicole.com
-
vrabuglhdkgmvwgaqpre.com
-
thelesterprize.com
-
wwwty66601.com
-
hmueu.com
-
thehelixnebula.com
-
voyagetime.online
-
smileslow.win
-
ristorantedialettale.com
-
dewangadventures.com
-
nakalotto.info
-
gamephonics.com
-
akustikses.com
-
tvlk-pay.com
-
jsxzlsjx.com
-
encomiumsenttlzhwt.download
-
finddentureimplantnow.sale
-
rickcrowracing.com
-
lingzuishuo.com
-
lifeassurancepasargad.com
-
wowcareguide.com
-
pizzafirelogs.com
-
vantagevehiclesigns.com
-
bkbgroup.net
-
foundmoneyfornonprofits.com
-
findyourkeven.today
-
suanli8.com
-
bbin8686.com
-
952cjy.info
-
americanbestfoodus.com
-
otiumlandscapedesign.com
-
varrado.com
-
jiaosini.com
-
magentamedicalcenter.com
-
adventure-parc-snowdonia.com
-
securityexpressmagazine.com
-
66477.net
-
objetsconnectes-store.com
-
senegalmatelas.com
-
tryseoagency.com
Targets
-
- Target PAYMENT UPDATE DEBIT NOTEINVOICE NO. SUVI20-0813_PDF.exe
- Size 604KB
- SHA256 464ffb9a16b269537c0b4475ebe897cc2bb1e0e8d35b0da24aaf21d677a5bf02
- MD5 073069364ffe216c15cf66a0da41730d
- SHA1 4007e0960f791dba1eeaadba5acad5c91e8e9552
- SHA512 6e98b5d8417178d25225b1b4d42bb4a0cac3f530f1cbec07a1cf578a01133d61abb2588bb48342a28e09fb0851cc9485ae3c898e09fb626c36881d6f83eb74ab
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext