General
- Target Mv Maersk Kleven V949E_pdf.exe
- Size 913KB
- Sample210118-e9mvr1wm9e
- SHA256 b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
- MD5 5281385b7bdbdbd17e1e08d1c0eb1a20
- SHA1 f2a17bff838159ff075ceb276335e6235195f62a
- SHA512 d1e50d40531c85046b01f7df66024d716a6f5e25b3a099465183804f0657fcfcf963c1056cdd7d95c88b6b3ba509ffed19048298dfb28e682ed0cc89f146acf7
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Mv Maersk Kleven V949E_pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.embracingmyjourney.net/p7t/
-
crosvudigital.com
-
airgreenllc.com
-
epochryphal.com
-
handy-domain-listing.com
-
espaceideecreation.com
-
3sleeves.com
-
alotrooms.com
-
luttelion.com
-
efekaleci.xyz
-
allpapas.com
-
alverazricardez.com
-
meghandoria.com
-
deicorp-community.com
-
877nz.com
-
bahmanhochmetalwerks.com
-
teppeisugaya.com
-
kitrablog.digital
-
theatermoviebuying.com
-
ptlycloudy.com
-
ablehed.pro
-
tolsecuremessagino.com
-
threepillarsofhealth.com
-
terrafirma-realty.com
-
ferreteriachiclana.com
-
badland-guns.com
-
emdidg.net
-
amazingchristianschool.com
-
delunmolding.com
-
laurencosiovocalstudio.com
-
ayrelon.com
-
serenderturizm.com
-
meet2night.site
-
lyoml.com
-
samarclinic.info
-
styvet.com
-
chriswoodgolf.com
-
htgginsure.com
-
bbvqcompass.com
-
reggielawfirm.com
-
graphix3dpromotions.com
-
surla.club
-
dlhexiang.com
-
awalkerfamilylaw.com
-
kingdofficial.online
-
qbluedotvrwd.com
-
porolonsamostroi.com
-
anametz.com
-
losrentablesdeoro.com
-
yax31.com
-
loudlocks.com
-
freisaq.com
-
digitalwalletsnews.com
-
mymaymotors.com
-
ecommerceeu.com
-
mtvoniline24.com
-
obluedotsmartshop.com
-
phantomgoat.com
-
dulcevazques.com
-
excession.network
-
abnehm-quiz.online
-
toyreel.com
-
kingdom-steel.com
-
grandmasalt.com
-
boykinspto.com
Targets
-
- Target Mv Maersk Kleven V949E_pdf.exe
- Size 913KB
- SHA256 b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
- MD5 5281385b7bdbdbd17e1e08d1c0eb1a20
- SHA1 f2a17bff838159ff075ceb276335e6235195f62a
- SHA512 d1e50d40531c85046b01f7df66024d716a6f5e25b3a099465183804f0657fcfcf963c1056cdd7d95c88b6b3ba509ffed19048298dfb28e682ed0cc89f146acf7
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext