General
-
Target
SCAN_20210112_132640143,pdf.exe
-
Size
842KB
-
Sample
210112-rw5nn2ykvx
-
MD5
e079c68325f24f2ddd7c677d3d90393c
-
SHA1
9230905d50e7a13937bb1f076f63f0da962864c1
-
SHA256
be770e407dcedcafe214f75273fbbbd7264c1c7c48dbc6da8764add43296adce
-
SHA512
022a7f5285d9dfe6222761da6586a39915f2e03a0b494c47abcf32da2fe53dde7c963a089cf13c2dd68bce7fc88a532e8435dd6c319144597e037a2ec8bb019a
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_20210112_132640143,pdf.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.alterhigh.com/rmck/
alltechengwork.com
shegotit.club
transactionshelper.com
aarhamworld.com
iitiansparth.com
beattymortgagepro.com
minipipette.com
bthefutureclothing.com
dressmids.com
multitype.one
searchtigo.com
thewildernessshed.store
pizzony.com
telescopiostop.com
commercialroof.guru
afiliatexcatalogo.com
hhzthg.com
keluojia.com
abergele.wales
finnexiia.com
longbaoqm.com
autornann.com
peterreutlinger.com
artcratic.com
themaverickfulfillment.com
cadenelson.com
kmc-commerce.com
mariadaras.com
mothersuperioreatery.com
innbebidas.com
securitymastersucks.com
chillzone.network
xn--537d.net
kelseywalton.com
contabecker.com
mmeautoaz.com
colombianpowerenergydrink.com
vulcanproxies.com
danshenjinrong.com
salivasamples.com
deerline.net
advanturebase.com
avaluoce.com
gemmaholloway.com
tamanjaya.online
trustsunion.com
jessfinancial.com
wdazhekou.com
devscash.com
thirted.com
prepperblog2020.com
miseguridad.net
htoomarketing.com
kralbonus1.net
malibuclassix.com
praciden.club
whatsagrouplinks.com
bii.doctor
paypal-ilimitado.com
psm-gen.com
simplysweetwithsarah.com
fitfusestore.com
pratikbirikim.com
sandtquickstop.com
Targets
-
-
Target
SCAN_20210112_132640143,pdf.exe
-
Size
842KB
-
MD5
e079c68325f24f2ddd7c677d3d90393c
-
SHA1
9230905d50e7a13937bb1f076f63f0da962864c1
-
SHA256
be770e407dcedcafe214f75273fbbbd7264c1c7c48dbc6da8764add43296adce
-
SHA512
022a7f5285d9dfe6222761da6586a39915f2e03a0b494c47abcf32da2fe53dde7c963a089cf13c2dd68bce7fc88a532e8435dd6c319144597e037a2ec8bb019a
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-