General
- Target RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
- Size 1.4MB
- Sample210119-n2fqchfkc2
- SHA256 458bd08f0c32719adc9d2858721b609b136ff0e21c2f3ac3f4be4f97e4084b7a
- MD5 d4318c1bca3df9f7cf9dd429da7fe4c6
- SHA1 bdfcb11a49b358d3c95a3ba8dfdb7757512234fb
- SHA512 afec2d60fcdece43e7b1ef33c6278d06916f5a8163756babb8c5c89350c98cd0aed2d6456f037697240436c4a7417d7199abd364fad6f575102b4ef5fc82590f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.thedilleyo.com/kb8/
-
goodsforbuilders.com
-
dafuhe.com
-
parapharmacity.com
-
montclairymcamotionvibe.com
-
jamesmccloudart.com
-
reignfallentertainment.com
-
couplesforequality.com
-
pitchbop.com
-
minipresspaperco.com
-
venoam.com
-
so-paradise.com
-
surgeryprovider.com
-
donaldscareers.com
-
disney-funlife.com
-
biosolo.net
-
themodsmith.net
-
grandhawaiian.com
-
11mountains.com
-
immatesearch.com
-
stochastichq.com
-
buroyellow.com
-
blackpopsatl.com
-
trivietdesign.com
-
freedomauthor.com
-
barinvestmentgroup.com
-
atlantisbeautym.com
-
compresedairsystems.com
-
negociobrilhante.com
-
glenviewpulse.com
-
charterforengagement.com
-
athelon.academy
-
1000-help19.club
-
startebgine.com
-
kestega.com
-
bowieliving.com
-
ecotechprime.com
-
thenewwayofliving.com
-
celerindustrial.com
-
uniqueama.com
-
gedankenspiel-coaching.com
-
informed-citizenry.com
-
xn--fiqvr53rcnhev5b7vo.com
-
ericnewburyparkhomes.com
-
cmdp0o7mi0-e.info
-
weavrfish.com
-
freisaq.com
-
assuredoutcomesllc.com
-
findingmytao.com
-
br9898.com
-
tinyschoolstyle.com
-
bavarian-luxury.com
-
over50legalplan.com
-
bartimeu.com
-
land-fair.com
-
archeologique.com
-
wedesignonline.net
-
anna-mueller.design
-
spielkorb.com
-
nwflworkcomp.com
-
abyafashion.com
-
allrenovationcompany.com
-
hayalspel.com
-
2664senter264.com
-
jgmerino.com
Targets
-
- Target RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
- Size 1.4MB
- SHA256 458bd08f0c32719adc9d2858721b609b136ff0e21c2f3ac3f4be4f97e4084b7a
- MD5 d4318c1bca3df9f7cf9dd429da7fe4c6
- SHA1 bdfcb11a49b358d3c95a3ba8dfdb7757512234fb
- SHA512 afec2d60fcdece43e7b1ef33c6278d06916f5a8163756babb8c5c89350c98cd0aed2d6456f037697240436c4a7417d7199abd364fad6f575102b4ef5fc82590f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext