General
-
Target
PO_JAN907#092941_BARYSLpdf.exe
-
Size
928KB
-
Sample
210118-yqj2kmcqt6
-
MD5
e24296acfd8c4ec1fb1e5b4b9379be14
-
SHA1
cdfcde4ab8907b98d3266eb1f80afa43821fb764
-
SHA256
7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393
-
SHA512
8123f2ab10402f61238d4468c472d23d7cd9788e2f01f3ea8eaf08130a576dad534ebc38329009f54f60ac23b92a26bc792a79426a35c7ac8f964148fa5dd2ac
Static task
static1
Behavioral task
behavioral1
Sample
PO_JAN907#092941_BARYSLpdf.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.thedilleyo.com/kb8/
goodsforbuilders.com
dafuhe.com
parapharmacity.com
montclairymcamotionvibe.com
jamesmccloudart.com
reignfallentertainment.com
couplesforequality.com
pitchbop.com
minipresspaperco.com
venoam.com
so-paradise.com
surgeryprovider.com
donaldscareers.com
disney-funlife.com
biosolo.net
themodsmith.net
grandhawaiian.com
11mountains.com
immatesearch.com
stochastichq.com
buroyellow.com
blackpopsatl.com
trivietdesign.com
freedomauthor.com
barinvestmentgroup.com
atlantisbeautym.com
compresedairsystems.com
negociobrilhante.com
glenviewpulse.com
charterforengagement.com
athelon.academy
1000-help19.club
startebgine.com
kestega.com
bowieliving.com
ecotechprime.com
thenewwayofliving.com
celerindustrial.com
uniqueama.com
gedankenspiel-coaching.com
informed-citizenry.com
xn--fiqvr53rcnhev5b7vo.com
ericnewburyparkhomes.com
cmdp0o7mi0-e.info
weavrfish.com
freisaq.com
assuredoutcomesllc.com
findingmytao.com
br9898.com
tinyschoolstyle.com
bavarian-luxury.com
over50legalplan.com
bartimeu.com
land-fair.com
archeologique.com
wedesignonline.net
anna-mueller.design
spielkorb.com
nwflworkcomp.com
abyafashion.com
allrenovationcompany.com
hayalspel.com
2664senter264.com
jgmerino.com
Targets
-
-
Target
PO_JAN907#092941_BARYSLpdf.exe
-
Size
928KB
-
MD5
e24296acfd8c4ec1fb1e5b4b9379be14
-
SHA1
cdfcde4ab8907b98d3266eb1f80afa43821fb764
-
SHA256
7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393
-
SHA512
8123f2ab10402f61238d4468c472d23d7cd9788e2f01f3ea8eaf08130a576dad534ebc38329009f54f60ac23b92a26bc792a79426a35c7ac8f964148fa5dd2ac
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-