General
- Target payment advice00000789_pdf.exe
- Size 866KB
- Sample210112-hs5jccmade
- SHA256 c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
- MD5 a08fc6065952b6625893e48a8bc72106
- SHA1 7b4baec718caa9c5a3aa7cbe1d85121af68f810b
- SHA512 2edcf7922cdd41d2b30ef3abb734a79a21ace178f8ea100067077be7ff5aca470e2000f869b839aca27b86ea4da9bdefcbc408de19e4e461a082fe5c7c916974
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
payment advice00000789_pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.aftabzahur.com/wgn/
-
kokokara-life-blog.com
-
faswear.com
-
futureleadershiptoday.com
-
date4done.xyz
-
thecouponinn.com
-
bbeycarpetsf.com
-
propolisnasalspray.com
-
jinjudiamond.com
-
goodevectors.com
-
nehyam.com
-
evalinkapuppets.com
-
what-if-statistics.com
-
rateofrisk.com
-
impacttestonlinne.com
-
servis-kaydet.info
-
coloniacafe.com
-
marcemarketing.com
-
aarigging.com
-
goddesswitchery.com
-
jasqblo.icu
-
ballotlocations.com
-
opulentredesign.com
-
nicolakwan.com
-
timcarecskh.online
-
albertaeatsfood.com
-
impactnwf.com
-
transportersolutions.com
-
jkfdjkdjkfjkddre.com
-
haslvapps.com
-
oakhazelnut.com
-
jazzyfans.net
-
uklcp.com
-
genericfreeemailservice.com
-
jettbay.com
-
utahcommunitynewsnetwork.com
-
vinos-online.com
-
lafatime.com
-
2438kingsland.com
-
groovepags.com
-
locationwhiz.com
-
edu1center.com
-
chronic-trauma.com
-
ytr.xyz
-
airconacademy-courses.com
-
gawafeqauibne.com
-
flowcedure.com
-
bwproskill.com
-
woodenbros.com
-
thesearsgroupnc.com
-
whoaminot.com
-
addvations.com
-
fatboidonuts.com
-
mobileworkforcevpn.net
-
offto.site
-
tehospedamos.com
-
nadinerae.com
-
betherightcandidate.com
-
ethosgov.com
-
cgbaran.com
-
xynewadmrykaa.com
-
socialdistancing.cool
-
kedalamsapi.com
-
hendifishing.online
-
geniusprosolutions.com
Targets
-
- Target payment advice00000789_pdf.exe
- Size 866KB
- SHA256 c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
- MD5 a08fc6065952b6625893e48a8bc72106
- SHA1 7b4baec718caa9c5a3aa7cbe1d85121af68f810b
- SHA512 2edcf7922cdd41d2b30ef3abb734a79a21ace178f8ea100067077be7ff5aca470e2000f869b839aca27b86ea4da9bdefcbc408de19e4e461a082fe5c7c916974
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext