General
- Target do202120102_010010101001010.pdf.exe
- Size 883KB
- Sample210221-pspywbcmmj
- SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45
- MD5 c88a43469800fcd034790256cf9440c8
- SHA1 f20cecc9f753659ca7d1ce627fd4813d81e4adad
- SHA512 777840057367b76524d5c65390c6f925ec8abb347f11eec08375ae9547fca8509f38a285c63c80fe10318e0d8ce5e34726a9c1d3d4a6ff557cad1a9625260ac4
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
do202120102_010010101001010.pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.coincrush.net/fzd/
-
vn-mua-hang-onlike.site
-
creationsbylisaq.com
-
clouduwo.com
-
archlvedata.com
-
casanoriamaderas.com
-
plouceur.com
-
thrivewarrioracademy.com
-
saraviafirma.com
-
letstalktech.tech
-
rhetfox.com
-
clmssouth.com
-
thecatstits.net
-
mepain.space
-
thepapaya.xyz
-
gaplek.net
-
llcom.net
-
estrategassocial.com
-
sliming.life
-
progressofindia.com
-
fakedoctorsrealfriendsmerch.com
-
worthlyzer.com
-
peternewprojects.com
-
eagle-rock-real-estate.com
-
bithypo.com
-
barberberlin.com
-
nvgrentals.com
-
citestaccnt1597729540.com
-
killercinema.com
-
mylifeonthenet.com
-
glcnac.com
-
popdaz.com
-
budgetcaptain.com
-
naseebnasrat.com
-
cryptoshop247.com
-
charismacatering.com
-
basafishrecipes.com
-
themodishgirl.com
-
birmeie.com
-
sunnyday.life
-
retireindy.com
-
collgescheduler.com
-
ebonyex.com
-
west2-trans.site
-
cashhomebuyersofamerica.com
-
krzonline.com
-
herusesee.com
-
sbssworkbook.com
-
omahalincolnpartybus.com
-
yeasuc.com
-
netsdefeats.store
-
jukafaka.com
-
benotigen.com
-
jameshamiltonphoto.com
-
t8kj.com
-
caledoniapropertybuyers.com
-
familyvitaic.com
-
pyramidc.com
-
fortbenningphotosleonards.com
-
thetestlive.com
-
claudest-jacques.com
-
alquimiadasletras.com
-
mfm-indonesia.com
-
kwaemulti.com
-
3dbootcamp.com
Targets
-
- Target do202120102_010010101001010.pdf.exe
- Size 883KB
- SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45
- MD5 c88a43469800fcd034790256cf9440c8
- SHA1 f20cecc9f753659ca7d1ce627fd4813d81e4adad
- SHA512 777840057367b76524d5c65390c6f925ec8abb347f11eec08375ae9547fca8509f38a285c63c80fe10318e0d8ce5e34726a9c1d3d4a6ff557cad1a9625260ac4
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext