General
-
Target
4700011885 spirit airline spares purchase order-romaero.pdf.exe
-
Size
673KB
-
Sample
201205-b8pcl2gyex
-
MD5
2a6da285d3fe9f86598cd708cc9aadbd
-
SHA1
c4ae1fb228a823ca1ae416e78fc817c66445b8dc
-
SHA256
928c710fc7eaa23a9b84ab77dc39377dc4a0782e3482d8bbda505f955b37d2f8
-
SHA512
9161ff08329c87ba1f006837b9fb30fe987b6e9ce33f4d7d7015c8c05c3735fd3c6e7ddc86591213d5dbb9737a006835790df6f60d7afac4b4f1c3cd96c3471a
Malware Config
Extracted
formbook
http://www.evana-rohanihijab.com/iic6/
capableandresilient.com
listaprzygod.com
cashhomeprogram.com
aboutwheelchair.com
clk4milli.club
asakitreks.com
liquiddreamworld.com
uqur88.com
bestifystore.com
arancionehq.xyz
mmoimperium.com
houxinjian.com
satmonitoring.com
tidalhaven.com
blcdevelopers.com
piratesofthefun.com
kadopulsa.com
xn--o39au6k0nm4rghsaq0c.net
wxxxtw.com
kyrtjf.com
Targets
-
-
Target
4700011885 spirit airline spares purchase order-romaero.pdf.exe
-
Size
673KB
-
MD5
2a6da285d3fe9f86598cd708cc9aadbd
-
SHA1
c4ae1fb228a823ca1ae416e78fc817c66445b8dc
-
SHA256
928c710fc7eaa23a9b84ab77dc39377dc4a0782e3482d8bbda505f955b37d2f8
-
SHA512
9161ff08329c87ba1f006837b9fb30fe987b6e9ce33f4d7d7015c8c05c3735fd3c6e7ddc86591213d5dbb9737a006835790df6f60d7afac4b4f1c3cd96c3471a
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-