General
- Target Purchase Order pdf.exe
- Size 764KB
- Sample210221-41gmnkjc8n
- SHA256 1d0aa1485b2e4d3e411e2d2e9ddfc3763120082cc039972770d5aa882fd4cb87
- MD5 2b488bf47e80bec2e9627ea2546be342
- SHA1 c8340861f211771613e4c07c9af06e66eaa51a5d
- SHA512 497a7366b34622e53c57fdf6dd2bb675f0259efb424f119d428d3a0e79ba50e87a1f12df4a107532025da17e70f9bd7ae18dfa1645eefcfef1feffb7ca4ba6be
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.brasilseo.com/bft/
-
edenicities.com
-
buntingfordhomeservices.com
-
nuanceproducoes.com
-
divasinspire.com
-
capiturn.com
-
zbjsn.com
-
thegioicaytrongnha.com
-
featherventure.com
-
onbrandtrading.com
-
sanguoban.com
-
doorman.pro
-
ourhomie.net
-
iwassickonholiday.com
-
mrcskin.com
-
reallycoolmask.com
-
tkrbeautyinstitut.com
-
keytomiami.com
-
sesliduybeni.com
-
asherwebber.com
-
starkweatherwindows.net
-
btcdqr.com
-
bodvlog.com
-
justice-facile.com
-
mysuccessmatters.com
-
devperformancesystems.com
-
desk-tech.com
-
uyhams.com
-
awakenwithrochelle.com
-
brpodiatrist2.com
-
sparklycleanhome.com
-
huiduog.com
-
rxb.xyz
-
thfarm.info
-
champagneveuveclicquot.wine
-
carolinaboterocorrea.com
-
cqwodeer.com
-
sportsplanetenterprises.com
-
cindyarguello.com
-
txcxxx.com
-
bullishonpennies.com
-
danddprecision.com
-
quietflyte.com
-
fastworldbd.com
-
savingz1.info
-
bluecapitalci.com
-
youridolz.com
-
andredeklerk.com
-
hawatt.com
-
tryangel.store
-
memorastudio.com
-
damiansaint.net
-
kozipets.com
-
mmafightsport.com
-
alboran4.com
-
ensignmusic.com
-
southerneatzatl.com
-
contrarrie.com
-
pastissadebeach.com
-
desingjad.com
-
glupemajice.com
-
kantoi.net
-
rambaudmail.com
-
gokaka.com
-
marcoded.com
Targets
-
- Target Purchase Order pdf.exe
- Size 764KB
- SHA256 1d0aa1485b2e4d3e411e2d2e9ddfc3763120082cc039972770d5aa882fd4cb87
- MD5 2b488bf47e80bec2e9627ea2546be342
- SHA1 c8340861f211771613e4c07c9af06e66eaa51a5d
- SHA512 497a7366b34622e53c57fdf6dd2bb675f0259efb424f119d428d3a0e79ba50e87a1f12df4a107532025da17e70f9bd7ae18dfa1645eefcfef1feffb7ca4ba6be
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext