General
- Target DHL DOCS..exe
- Size 269KB
- Sample201214-2lqljyb2wa
- SHA256 cfa7189e67e325a2893d1b50cb4e6e477e30a012fb462bdf3d19b7e9e4ab8778
- MD5 3b73cdfddb80d14b360df205c210ef28
- SHA1 98ed55d056f5bb421090dac00534769dd1b01fff
- SHA512 4f76c373d265a80793d67d64c84f96277ed665fa6c751ef34df94a5c1a3dacf42459c72383438a6804ad98035395dcb16ceaa83195c439bdc8a0e9839dc621a9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
DHL DOCS..exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.newenglandredsox.com/lsa/
-
funeralplansguide.com
-
weilandconstruction.com
-
newbiecasinos.com
-
xyzcomis.com
-
tequilasportfishingteam.com
-
lifesiizebeauty.com
-
consultoriostimbe.com
-
thedoughmad.com
-
lametserlx.com
-
tuchiasobi.com
-
polimarktrade.com
-
indicatormarket.com
-
bizbajar.site
-
toptimesharetalents.com
-
morrobaywindowcleaning.com
-
rare-snare.com
-
dnascreener.com
-
askwhat.space
-
toutsurlebio-nature.com
-
insidetauck.com
-
primesnooker.com
-
huoduola.com
-
pinistat.com
-
silkyrobe.com
-
coinbetgames.com
-
surptalb.xyz
-
dylanfry.com
-
pediapanel.com
-
huangming123.com
-
id-support-verification.com
-
trail.energy
-
writenowpress.com
-
industriousgame.net
-
adventuresofbusiness.com
-
hairperfectionist.com
-
tamilmentor.online
-
gordonswellrv.com
-
bohemiangoddessvibes.com
-
szly9188.com
-
homesellingqueen.com
-
jeffkong95.com
-
thelaundering.com
-
overheadview.com
-
grandslamhandyman.com
-
mammoth4runner.com
-
andrewflora.com
-
wonderpit.com
-
yarus.host
-
transglobeblog.com
-
fearnotsecurity.net
-
meedaz.com
-
arielkowalski.com
-
longhornsfangear.com
-
awakeandaware.today
-
jusimpress.com
-
sbkrecharge.com
-
go4itinternational.com
-
parkonurdrive.com
-
poywuo.com
-
transcriptionworker.com
-
seasonsofsoul.com
-
sorted2020.com
-
umbay.info
-
semisolutionsusa.info
Targets
-
- Target DHL DOCS..exe
- Size 269KB
- SHA256 cfa7189e67e325a2893d1b50cb4e6e477e30a012fb462bdf3d19b7e9e4ab8778
- MD5 3b73cdfddb80d14b360df205c210ef28
- SHA1 98ed55d056f5bb421090dac00534769dd1b01fff
- SHA512 4f76c373d265a80793d67d64c84f96277ed665fa6c751ef34df94a5c1a3dacf42459c72383438a6804ad98035395dcb16ceaa83195c439bdc8a0e9839dc621a9
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext