General
-
Target
2020112395387_pdf.exe
-
Size
390KB
-
Sample
201126-vympd1n2ts
-
MD5
e54d832cb872b7dc086ab7a7878d38fb
-
SHA1
dd865deaffa4558eebebcb83b5335de2b0b26327
-
SHA256
06a0e3845d7b4c5593a9143eb1ae73223760d68f2acf0e5be631b9eeab3675f3
-
SHA512
04a78936551df1bf62d4b256c2a5888af840d9f1fb1735810b1c5145af0795c6c84e03b66754137242691aa0ffa26ceb7295d3cdc59323b939daa8d7cb24bac0
Malware Config
Extracted
formbook
http://www.blog-cybersecurite.net/ogg/
constmotion.com
castinginiciadas.com
dalvgroup.com
dmetuningkw.com
everygrindcount.com
lovewrendley.com
yourtallahassee.com
healer-jou.com
china-gadge.com
theplatinumworld.com
rakutenlle.xyz
neroflex.com
zdysks.com
e-learningorange.com
starbleach.com
apexappsllc.com
sinteredsurface.com
upcas.info
monetizemybizadvertisers.com
tsptoolbox.net
Targets
-
-
Target
2020112395387_pdf.exe
-
Size
390KB
-
MD5
e54d832cb872b7dc086ab7a7878d38fb
-
SHA1
dd865deaffa4558eebebcb83b5335de2b0b26327
-
SHA256
06a0e3845d7b4c5593a9143eb1ae73223760d68f2acf0e5be631b9eeab3675f3
-
SHA512
04a78936551df1bf62d4b256c2a5888af840d9f1fb1735810b1c5145af0795c6c84e03b66754137242691aa0ffa26ceb7295d3cdc59323b939daa8d7cb24bac0
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-