General
- Target SCAN_20210112_132640143,pdf.exe
- Size 842KB
- Sample210112-rw5nn2ykvx
- SHA256 be770e407dcedcafe214f75273fbbbd7264c1c7c48dbc6da8764add43296adce
- MD5 e079c68325f24f2ddd7c677d3d90393c
- SHA1 9230905d50e7a13937bb1f076f63f0da962864c1
- SHA512 022a7f5285d9dfe6222761da6586a39915f2e03a0b494c47abcf32da2fe53dde7c963a089cf13c2dd68bce7fc88a532e8435dd6c319144597e037a2ec8bb019a
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_20210112_132640143,pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.alterhigh.com/rmck/
-
alltechengwork.com
-
shegotit.club
-
transactionshelper.com
-
aarhamworld.com
-
iitiansparth.com
-
beattymortgagepro.com
-
minipipette.com
-
bthefutureclothing.com
-
dressmids.com
-
multitype.one
-
searchtigo.com
-
thewildernessshed.store
-
pizzony.com
-
telescopiostop.com
-
commercialroof.guru
-
afiliatexcatalogo.com
-
hhzthg.com
-
keluojia.com
-
abergele.wales
-
finnexiia.com
-
longbaoqm.com
-
autornann.com
-
peterreutlinger.com
-
artcratic.com
-
themaverickfulfillment.com
-
cadenelson.com
-
kmc-commerce.com
-
mariadaras.com
-
mothersuperioreatery.com
-
innbebidas.com
-
securitymastersucks.com
-
chillzone.network
-
xn--537d.net
-
kelseywalton.com
-
contabecker.com
-
mmeautoaz.com
-
colombianpowerenergydrink.com
-
vulcanproxies.com
-
danshenjinrong.com
-
salivasamples.com
-
deerline.net
-
advanturebase.com
-
avaluoce.com
-
gemmaholloway.com
-
tamanjaya.online
-
trustsunion.com
-
jessfinancial.com
-
wdazhekou.com
-
devscash.com
-
thirted.com
-
prepperblog2020.com
-
miseguridad.net
-
htoomarketing.com
-
kralbonus1.net
-
malibuclassix.com
-
praciden.club
-
whatsagrouplinks.com
-
bii.doctor
-
paypal-ilimitado.com
-
psm-gen.com
-
simplysweetwithsarah.com
-
fitfusestore.com
-
pratikbirikim.com
-
sandtquickstop.com
Targets
-
- Target SCAN_20210112_132640143,pdf.exe
- Size 842KB
- SHA256 be770e407dcedcafe214f75273fbbbd7264c1c7c48dbc6da8764add43296adce
- MD5 e079c68325f24f2ddd7c677d3d90393c
- SHA1 9230905d50e7a13937bb1f076f63f0da962864c1
- SHA512 022a7f5285d9dfe6222761da6586a39915f2e03a0b494c47abcf32da2fe53dde7c963a089cf13c2dd68bce7fc88a532e8435dd6c319144597e037a2ec8bb019a
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext