General
- Target RFQ - ASTROFREIGHT FEB21-0621pdf.exe
- Size 474KB
- Sample210209-kxt53vatjj
- SHA256 044d4416e986fb7fd91bc96639efe48e87cfd33857e199c48cf6e7f4d07a3db2
- MD5 6d6e99dd5f60c2d450885c73734eae9c
- SHA1 d5bd4f6bc9539ce53411ae35964e0bb606501fe0
- SHA512 7288dcbae52038cb39814c32f2410962bff701b394071067dbd2a290cc04ae19c42cd70921a67de4a26959f22b2daf7f9b3f1fc102f336a63fea73f7649d5c94
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - ASTROFREIGHT FEB21-0621pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.thedilleyo.com/kb8/
-
goodsforbuilders.com
-
dafuhe.com
-
parapharmacity.com
-
montclairymcamotionvibe.com
-
jamesmccloudart.com
-
reignfallentertainment.com
-
couplesforequality.com
-
pitchbop.com
-
minipresspaperco.com
-
venoam.com
-
so-paradise.com
-
surgeryprovider.com
-
donaldscareers.com
-
disney-funlife.com
-
biosolo.net
-
themodsmith.net
-
grandhawaiian.com
-
11mountains.com
-
immatesearch.com
-
stochastichq.com
-
buroyellow.com
-
blackpopsatl.com
-
trivietdesign.com
-
freedomauthor.com
-
barinvestmentgroup.com
-
atlantisbeautym.com
-
compresedairsystems.com
-
negociobrilhante.com
-
glenviewpulse.com
-
charterforengagement.com
-
athelon.academy
-
1000-help19.club
-
startebgine.com
-
kestega.com
-
bowieliving.com
-
ecotechprime.com
-
thenewwayofliving.com
-
celerindustrial.com
-
uniqueama.com
-
gedankenspiel-coaching.com
-
informed-citizenry.com
-
xn--fiqvr53rcnhev5b7vo.com
-
ericnewburyparkhomes.com
-
cmdp0o7mi0-e.info
-
weavrfish.com
-
freisaq.com
-
assuredoutcomesllc.com
-
findingmytao.com
-
br9898.com
-
tinyschoolstyle.com
-
bavarian-luxury.com
-
over50legalplan.com
-
bartimeu.com
-
land-fair.com
-
archeologique.com
-
wedesignonline.net
-
anna-mueller.design
-
spielkorb.com
-
nwflworkcomp.com
-
abyafashion.com
-
allrenovationcompany.com
-
hayalspel.com
-
2664senter264.com
-
jgmerino.com
Targets
-
- Target RFQ - ASTROFREIGHT FEB21-0621pdf.exe
- Size 474KB
- SHA256 044d4416e986fb7fd91bc96639efe48e87cfd33857e199c48cf6e7f4d07a3db2
- MD5 6d6e99dd5f60c2d450885c73734eae9c
- SHA1 d5bd4f6bc9539ce53411ae35964e0bb606501fe0
- SHA512 7288dcbae52038cb39814c32f2410962bff701b394071067dbd2a290cc04ae19c42cd70921a67de4a26959f22b2daf7f9b3f1fc102f336a63fea73f7649d5c94
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext