General
- Target DK Purchase Order 2021 - 00041.exe
- Size 1004KB
- Sample210322-skf4cjlrn6
- SHA256 58626b2130d20a2bacbcefa97d06dc1e4d55b123a86a3f074bd2e8212ee60ae8
- MD5 6164d8194adabb8cd5619c9fe22e61c7
- SHA1 7d8a0fa17e510fdb600a220022ef6cb290674970
- SHA512 29e6a2e65a000288fd1c301d367241e00c08c7bb2180d0591897d9630dc1791943a80b5cf3c1873ae21bb6302ca113a8eb36c79e3bf5821aaf11fb2ba723df5f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
DK Purchase Order 2021 - 00041.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.otokoikon.com/vsk9/
-
545earth.com
-
womandigitalrights.net
-
tczxsjw.com
-
tuvantuyensinh24h.com
-
augiocxqo.icu
-
textingtexan.com
-
cheaperwhere.com
-
owe.pink
-
canzonianni90.com
-
explorehisword.com
-
alexaglobe.com
-
comharbookkeeping.com
-
insportseurolatam.com
-
rockplaylists.com
-
masqueareas.com
-
peixunzx.com
-
loudmouse-ent.com
-
medtopharma.com
-
jokersupadte.com
-
axsm0815.com
-
mmc-mybox.com
-
atxrvrepair.com
-
homesecuritymx.site
-
cubekwt.com
-
clouddevopsteam.tech
-
qm7886.com
-
sweet-day.net
-
fzgdrzdb.com
-
automaticdataprocessing.sucks
-
homestylebutque.com
-
leonelorrala.com
-
accupi.com
-
kkkstuff4sale.com
-
greatskydroneservice.com
-
gutlabsllc.com
-
buildecks.com
-
watdomenrendi02.com
-
petrahappycorner.club
-
ht8957.com
-
billygoatoffroad.com
-
rebelblk.com
-
simplyshields.com
-
communal-sleeve.net
-
spiritualflava.com
-
arjservicos.com
-
neighborlyrepair.com
-
sheboyganshore.com
-
officialrichminds.com
-
flyolaairambulance.com
-
panicpillow.com
-
xn--6p1awe.club
-
902444444.net
-
bkgexqjg.icu
-
intothesean.com
-
atualizacao.net
-
conversenglish.com
-
skiphire-wolverhampton.com
-
jumlasx.xyz
-
loanhelpservices.com
-
chpcorporation-product.com
-
sixpackabstactics.com
-
esearsk.icu
-
llseatac.com
-
puckerandwinkbeauty.com
Targets
-
- Target DK Purchase Order 2021 - 00041.exe
- Size 1004KB
- SHA256 58626b2130d20a2bacbcefa97d06dc1e4d55b123a86a3f074bd2e8212ee60ae8
- MD5 6164d8194adabb8cd5619c9fe22e61c7
- SHA1 7d8a0fa17e510fdb600a220022ef6cb290674970
- SHA512 29e6a2e65a000288fd1c301d367241e00c08c7bb2180d0591897d9630dc1791943a80b5cf3c1873ae21bb6302ca113a8eb36c79e3bf5821aaf11fb2ba723df5f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext