General
- Target Outstanding payment Overdue for Invoice INV-2644.exe
- Size 801KB
- Sample201112-4f9p8wee6n
- SHA256 d5693be3b4e0d78485c00d409aedbe5cf18fd22c413fac48b44a4eaa0bbda668
- MD5 b85b5ff7eb8a03a9bff5f05a94d307e2
- SHA1 8a0cbfa051f3030036a92b0bd146f83c12df4973
- SHA512 a89780630514c62380caa147f6bc50860f5b0ece10b46cfc0529f97b07723326464690a5e9a57d9ffbb39d33664377256f5aee76fd98b979cfe4d783f9f109a5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Outstanding payment Overdue for Invoice INV-2644.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.pamforprogress.com/bg8v/
-
patrickzajda.com
-
40ye.com
-
foxyivys.com
-
higherstatusfreebook.com
-
pharmxpert.net
-
buyinglover.com
-
eresuli.com
-
officerrustensheskey.com
-
ghoster.agency
-
susanchanportfolio.com
-
etreunheros.com
-
yavcxas.com
-
jasonrbradwell.com
-
tods.info
-
hawksltd.com
-
rankpicker.net
-
rachelraydiet.com
-
foolishdrivers.com
-
amtpsychology.com
-
hffc365.com
-
triviumpoint.com
-
mymathstest.com
-
moonlightmoviestx.com
-
modelbyvmj.com
-
adhdo.net
-
melhist.com
-
masquesgratuits.com
-
lxcloakjs.site
-
zjnbxcy.com
-
designthnkr.com
-
myeyepupil.com
-
sunsetemploymentny.com
-
stkclass.com
-
octoberx2.online
-
critterapp.com
-
mytcfb.com
-
trumpdrama.com
-
sensoryshirts.com
-
inspiredartistsproductions.com
-
petereid.xyz
-
copyright-helpcentre-ig.com
-
drinkdel.com
-
kanmra.com
-
tinyhomeshopping.com
-
lb-s24b.online
-
freebayag.info
-
denso-si-solution.com
-
xifrainternacional.com
-
sausathaco.com
-
floratend.com
-
incomecoach.info
-
oarlike.com
-
dupedesigns.com
-
demanumachina.com
-
dreamwcandles.com
-
toledoinstruments.com
-
stageleftusa.com
-
jibenentreprenad.mobi
-
aconweb.com
-
wakethephoenix.com
-
veryinteresthing.com
-
reason.institute
-
adraeklo.com
-
dentistandlaboratories.com
Targets
-
- Target Outstanding payment Overdue for Invoice INV-2644.exe
- Size 801KB
- SHA256 d5693be3b4e0d78485c00d409aedbe5cf18fd22c413fac48b44a4eaa0bbda668
- MD5 b85b5ff7eb8a03a9bff5f05a94d307e2
- SHA1 8a0cbfa051f3030036a92b0bd146f83c12df4973
- SHA512 a89780630514c62380caa147f6bc50860f5b0ece10b46cfc0529f97b07723326464690a5e9a57d9ffbb39d33664377256f5aee76fd98b979cfe4d783f9f109a5
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext