General
-
Target
Alfa Laval Aalborg AS Statement of Account.xlsx
-
Size
1.7MB
-
Sample
210115-d7jypdlvfn
-
MD5
8a26ff06c494c96457f847edb7ca80c0
-
SHA1
a165479dde0175896cd0d70bb68616688bb7d328
-
SHA256
255389c8a0f1e5da9cd479450c1e80210c14a3e36fb47f0898f24aabc8a962db
-
SHA512
186686e95d7255b5d37b646eb1a2a7de07f2888c77a65cab4724c127d28cedd1e3fdac77af4cd74f8affecd10f637ab94844a7d27cb4528341ce0f0d8f5e597a
Static task
static1
Behavioral task
behavioral1
Sample
Alfa Laval Aalborg AS Statement of Account.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Alfa Laval Aalborg AS Statement of Account.xlsx
Resource
win10v20201028
Malware Config
Extracted
formbook
http://www.bytecommunication.com/aky/
jeiksaoeklea.com
sagame-auto.net
soloseriolavoro.com
thecreatorsbook.com
superskritch.com
oroxequipment.com
heart-of-art.online
liwedfg.com
fisherofsouls.com
jota.xyz
nehyam.com
smart-contact-delivery.com
hoom.guru
dgryds.com
thesoakcpd.com
mishv.com
rings-factory.info
bero-craft-beers.com
podcastnamegenerators.com
856379813.xyz
ruinfectious.com
wdcsupport.com
youngbrokeandeducated.com
shpments75.com
louisbmartinez100th.com
shining.ink
hkexpresswaterford.com
quickcashoffersatl.com
180cliniconline.com
mainriskintl.com
clinicadosorriso.com
kuxueyunkeji.com
smart-acumen.com
maisonkerlann.com
jewishposter.com
xn--w52b77ujva.com
antoniodevivo.com
diversitypatriots.com
tiotacos.company
ventumgi.com
ip-tv.online
smithvilletexashistory.com
amruta-varshini.com
wildpositive.com
alifezap.com
nczjt.net
palmsvillaswhitneyranch.com
experiencemoretogether.com
dewitfire.com
scruffynotfluffy.online
bazarsurtidorico.com
dayscosmetics.com
tpsvegas.com
externalboard.com
2125lynchmere.com
agroplenty.com
easterneuropemall.com
whtoys888.com
writehousepoint.com
ppeaceandgloves.com
sadtire.press
jj3994.com
smokenengines.com
offplanprojects-re.com
Targets
-
-
Target
Alfa Laval Aalborg AS Statement of Account.xlsx
-
Size
1.7MB
-
MD5
8a26ff06c494c96457f847edb7ca80c0
-
SHA1
a165479dde0175896cd0d70bb68616688bb7d328
-
SHA256
255389c8a0f1e5da9cd479450c1e80210c14a3e36fb47f0898f24aabc8a962db
-
SHA512
186686e95d7255b5d37b646eb1a2a7de07f2888c77a65cab4724c127d28cedd1e3fdac77af4cd74f8affecd10f637ab94844a7d27cb4528341ce0f0d8f5e597a
-
Formbook Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-