General
- Target Swift0011MGD.Scan.pdf..exe
- Size 650KB
- Sample201013-9h84l355rx
- SHA256 cc0807a29f920ca94099399975ae3d52b741d6f1387ea3fb26c44b1bc22cd95c
- MD5 eefea433bcfd7ef8b48bf9dbde529130
- SHA1 922f7bfd62df2146d37a91ecef07ad7aee9b3e2f
- SHA512 ca9dba69f016c09046b51f4921b8b6cb05a90ccc8afbc12354f09122000d6ca1d1e74d0658c615570ec18210e484ced8b914d8e749f0346ddfbc6840f77e99a3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Swift0011MGD.Scan.pdf..exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.darkatnightgame.com/fgn/
-
kynguyendongho.com
-
seedtoskinnc.com
-
islaplants.com
-
bobbyfarris.com
-
xn--mgbuhw0d7a.com
-
sitestart.site
-
blendedprintz.com
-
honestwholesale.com
-
shuttandco.com
-
iangroupfunnels.com
-
ohanavendors.com
-
matreejewels.com
-
paras.ltd
-
1005cy.com
-
birdiecrane.com
-
dauntlessdigitalmanagement.com
-
wownewtech.net
-
instantpeindia.com
-
toshimaen-uosen.com
-
tlctrueloveconnection.com
-
jfabulousblingz.com
-
bporg.com
-
midifitcamp.com
-
sag-tropez.com
-
funciona-mesmo.men
-
quizcrypto.com
-
efx999.com
-
zmcafa.com
-
tastyhandycandies.com
-
centric-d.com
-
spiritualitywithvee.com
-
satnhomtuandung.com
-
thatdentguy.com
-
progress-party.com
-
login-center-online.network
-
istys.com
-
finance04.com
-
aarthiramamurthy.com
-
tracemypreps.com
-
tamtrangthuocnam.info
-
mshldyx.com
-
paradenge.xyz
-
about-sexy.com
-
windowsthreatcenter.info
-
watchfulelephant.com
-
ysch5.com
-
arthritismobilityexercise.com
-
facemunch.com
-
samex-kv.com
-
vaultequestrian.com
-
minnano-leader-board.com
-
kenanxin.com
-
chengbo.online
-
mingzejiudian.club
-
alpha-roc.net
-
trungtamsuachuanguyenkimvn.com
-
polyrove.com
-
omidtebbi.com
-
qkvah.xyz
-
feetfet.net
-
travel-runway.com
-
6njjuyut.com
-
njcourierpost.com
-
viaholding.com
Targets
-
- Target Swift0011MGD.Scan.pdf..exe
- Size 650KB
- SHA256 cc0807a29f920ca94099399975ae3d52b741d6f1387ea3fb26c44b1bc22cd95c
- MD5 eefea433bcfd7ef8b48bf9dbde529130
- SHA1 922f7bfd62df2146d37a91ecef07ad7aee9b3e2f
- SHA512 ca9dba69f016c09046b51f4921b8b6cb05a90ccc8afbc12354f09122000d6ca1d1e74d0658c615570ec18210e484ced8b914d8e749f0346ddfbc6840f77e99a3
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext